theory Ipc_C

lemma getReceiveSlots_ccorres:
  "ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and>
           ((a \<noteq> []) = (c \<noteq> NULL)) \<and> (a\<noteq>[] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL))
           ret__ptr_to_struct_cte_C_'
           (valid_ipc_buffer_ptr' buffer and
              valid_pspace'  and
              tcb_at' thread
             and (\<lambda>s. buffer \<noteq> 0))
           (UNIV \<inter> \<lbrace>\<acute>buffer = Ptr buffer\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>) hs
           (getReceiveSlots thread (Some buffer))
           (Call getReceiveSlots_'proc)" apply (rule ccorres_gen_asm) apply (cinit lift: buffer_' thread_') apply (simp add: split_def) apply (ctac (no_vcg)) apply (rule ccorres_emptyOnFailure) apply csymbr apply (rule ccorres_split_nothrowE) apply (rule unifyFailure_ccorres) apply (ctac (no_vcg) add: lookupCap_ccorres') apply ceqv apply simp apply csymbr apply (fold lookupTargetSlot_def) apply (rule ccorres_split_nothrow_novcgE) apply (rule unifyFailure_ccorres) apply (ctac (no_vcg) add: lookupTargetSlot_ccorres') apply ceqv apply (rename_tac slot slot_c) apply (simp add: liftE_bindE) apply csymbr apply (rule_tac P="cte_at' slot and no_0_obj'"
                      in ccorres_from_vcg_throws[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: in_monad cte_wp_at_ctes_of Bex_def in_getCTE2) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (clarsimp simp: typ_heap_simps' cap_get_tag_isCap in_monad
                          dest!: ccte_relation_ccap_relation) apply (erule cte_at_0'[rotated], simp add: cte_wp_at_ctes_of) apply clarsimp apply (rule ccorres_split_throws) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def) apply (rule conseqPre, vcg, clarsimp) apply clarsimp apply (wp lsfco_cte_at') apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp simp: guard_is_UNIV_def) apply (rule UNIV_I) apply simp apply clarsimp apply (rule ccorres_split_throws) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def) apply (rule conseqPre, vcg, clarsimp) apply clarsimp apply wp apply (vcg exspec=lookupCap_modifies) apply clarsimp apply (wp loadCapTransfer_ctReceiveDepth) apply clarsimp apply (intro conjI) apply fastforce apply fastforce apply clarsimp apply (simp add: cct_relation_def) apply (case_tac rv, clarsimp) apply (rule UNIV_I)  \<comment> \<open>still a schematic here ...\<close> done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and> (a \<noteq> []) = (c \<noteq> NULL) \<and> (a \<noteq> [] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread and (\<lambda>s. buffer \<noteq> 0)) (UNIV \<inter> \<lbrace>\<acute>buffer = PTR(32 word) buffer\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>) hs (getReceiveSlots thread (Some buffer)) (Call getReceiveSlots_'proc) proof (prove)
goal (1 subgoal):
 1. buffer \<noteq> 0 \<Longrightarrow> ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and> (a \<noteq> []) = (c \<noteq> NULL) \<and> (a \<noteq> [] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) (UNIV \<inter> \<lbrace>\<acute>buffer = PTR(32 word) buffer\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>) hs (getReceiveSlots thread (Some buffer)) (Call getReceiveSlots_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and> (a \<noteq> []) = (c \<noteq> NULL) \<and> (a \<noteq> [] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q903 threada buffera) (?Q'903 threada buffera) (SKIP # hs) (do ct <- loadCapTransfer buffer;
emptyOnFailure (doE cnode <- unifyFailure (lookupCap thread (ctReceiveRoot ct));
slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex ct) (ctReceiveDepth ct));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE)
od) (IF buffera = NULL THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>ct :== CALL loadCapTransfer_'proc(buffera);;
(\<acute>cptr :== ctReceiveRoot_C \<acute>ct;;
(\<acute>luc_ret :== CALL lookupCap_'proc(threada,\<acute>cptr);;
(IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C \<acute>ct,ctReceiveDepth_C \<acute>ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))))))
 2. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q903 threada buffera s \<and> s' \<in> ?Q'903 threada buffera proof (prove)
goal (2 subgoals):
 1. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and> (a \<noteq> []) = (c \<noteq> NULL) \<and> (a \<noteq> [] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q903 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)) (?Q'903 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)) (SKIP # hs) (do ct <- loadCapTransfer buffer;
emptyOnFailure (doE cnode <- unifyFailure (lookupCap thread (ctReceiveRoot ct));
slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex ct) (ctReceiveDepth ct));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE)
od) (\<acute>ct :== CALL loadCapTransfer_'proc(PTR(32 word) buffer);;
(\<acute>cptr :== ctReceiveRoot_C \<acute>ct;;
(\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C \<acute>ct,ctReceiveDepth_C \<acute>ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>s. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))))))
 2. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q903 threada buffera s \<and> s' \<in> ?Q'903 threada buffera proof (prove)
goal (3 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a c. (a = [] \<or> (\<exists>slot. a = [slot])) \<and> (a \<noteq> []) = (c \<noteq> NULL) \<and> (a \<noteq> [] \<longrightarrow> c = cte_Ptr (hd a) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q924 threada buffera rv) (?Q'938 rv ct) (SKIP # hs) (emptyOnFailure (doE cnode <- unifyFailure (lookupCap thread (ctReceiveRoot rv));
slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE)) (\<acute>cptr :== ctReceiveRoot_C ct;;
(\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))))
 2. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>?Q924 threada buffera\<rbrace>
 3. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'937 threada buffera t rv}
flex-flex pairs:
\<lambda>t rv. ?Q'938 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?Q'937 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (3 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q924 threada buffera rv) (?Q'938 rv ct) (SKIP # hs) (doE cnode <- unifyFailure (lookupCap thread (ctReceiveRoot rv));
slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (\<acute>cptr :== ctReceiveRoot_C ct;;
(\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>cptr);;
(IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))))
 2. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>?Q924 threada buffera\<rbrace>
 3. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'937 threada buffera t rv}
flex-flex pairs:
\<lambda>t rv. ?Q'938 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?Q'937 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (3 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q924 threada buffera rv) (?G'1297 rv ct) (SKIP # hs) (doE cnode <- unifyFailure (lookupCap thread (ctReceiveRoot rv));
slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct);;
(IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))))
 2. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>?Q924 threada buffera\<rbrace>
 3. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> ?G'1298 threada buffera t rv}}
flex-flex pairs:
?G'1298 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) \<equiv>\<^sup>? \<lambda>t rv. ?G'1297 rv (ret__struct_cap_transfer_C_' t) proof (prove)
goal (8 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ccorres (?f'1616 threada buffera rv ct \<currency> ?r'1616 threada buffera rv ct) (liftxf (?es1616 threada buffera rv ct) (?ef'1616 threada buffera rv ct) (?vf'1616 threada buffera rv ct) (?xf'1616 threada buffera rv ct)) (?P1628 threada buffera rv) (?P'1624 rv ct) (SKIP # hs) (unifyFailure (lookupCap thread (ctReceiveRoot rv))) (\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct))
 2. \<And>threada buffera rv ct rv' t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1616 threada buffera rv ct) rv' t t' (IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))) (?d'1616 threada buffera rv ct rv')
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ?r'1616 threada buffera rv ct cnode (?vf'1616 threada buffera rv ct rv'); ?ef'1616 threada buffera rv ct rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 threada buffera rv ct cnode) (?Q'1616 threada buffera rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'1616 threada buffera rv ct rv')
 4. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ?ef'1616 threada buffera rv ct rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'1616 threada buffera rv ct err (?ef'1616 threada buffera rv ct rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (?d'1616 threada buffera rv ct rv')
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ?r'1616 threada buffera rv ct cnode (?vf'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s)) \<longrightarrow> s \<in> ?Q'1616 threada buffera rv ct cnode (?xf'1616 threada buffera rv ct s))) \<and> (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'1616 threada buffera rv ct err (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s)) (?es1616 threada buffera rv ct s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (?xf'1616 threada buffera rv ct s) (?es1616 threada buffera rv ct s)))}
 7. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. ?P1628 threada buffera a and ?R1626 threada buffera a\<rbrace>
 8. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> ?P'1622 threada buffera t rv \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?P'1624 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?P'1622 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (8 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ccorres (?f1635 threada buffera rv ct \<currency> ?r'1616 threada buffera rv ct) (liftxf (?es1616 threada buffera rv ct) (?ef'1616 threada buffera rv ct) (?vf'1616 threada buffera rv ct) (?xf'1616 threada buffera rv ct)) (?P1628 threada buffera rv) (?P'1624 rv ct) (SKIP # hs) (lookupCap thread (ctReceiveRoot rv)) (\<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct))
 2. \<And>threada buffera rv ct rv' t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1616 threada buffera rv ct) rv' t t' (IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))) (?d'1616 threada buffera rv ct rv')
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ?r'1616 threada buffera rv ct cnode (?vf'1616 threada buffera rv ct rv'); ?ef'1616 threada buffera rv ct rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 threada buffera rv ct cnode) (?Q'1616 threada buffera rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'1616 threada buffera rv ct rv')
 4. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ?ef'1616 threada buffera rv ct rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (?ef'1616 threada buffera rv ct rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (?d'1616 threada buffera rv ct rv')
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ?r'1616 threada buffera rv ct cnode (?vf'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s)) \<longrightarrow> s \<in> ?Q'1616 threada buffera rv ct cnode (?xf'1616 threada buffera rv ct s))) \<and> (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (?ef'1616 threada buffera rv ct (?xf'1616 threada buffera rv ct s)) (?es1616 threada buffera rv ct s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (?xf'1616 threada buffera rv ct s) (?es1616 threada buffera rv ct s)))}
 7. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. ?P1628 threada buffera a and ?R1626 threada buffera a\<rbrace>
 8. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> ?P'1622 threada buffera t rv \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?P'1624 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?P'1622 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (7 subgoals):
 1. \<And>threada buffera rv ct rv' t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> ceqv \<Gamma> luc_ret_' rv' t t' (IF lookupCap_ret_C.status_C \<acute>luc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C \<acute>luc_ret;;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))) (?d'1616 threada buffera rv ct rv')
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 threada buffera rv ct cnode) (?Q'1616 threada buffera rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'1616 threada buffera rv ct rv')
 3. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (?d'1616 threada buffera rv ct rv')
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> ?Q'1616 threada buffera rv ct cnode (luc_ret_' s))) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 6. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 7. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 threada buffera rv ct cnode) (?Q'1616 threada buffera rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> ?Q'1616 threada buffera rv ct cnode (luc_ret_' s))) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode) (?Q'1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))))
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> ?Q'1616 threada buffera rv ct cnode (luc_ret_' s))) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode) (?G'1938 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (\<acute>lus_ret :== CALL lookupTargetSlot_'proc(lookupCap_ret_C.cap_C rv',ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> ?G'1938 threada buffera rv ct cnode (luc_ret_' s)})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode) (?G'1938 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv') (SKIP # hs) (doE slot <- unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv));
cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (\<acute>lus_ret :== CALL lookupTargetSlot_'proc(lookupCap_ret_C.cap_C rv',ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>?Q1616 threada buffera rv ct\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> ?G'1938 threada buffera rv ct cnode (luc_ret_' s)})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (12 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?f'2161 threada buffera rv ct cnode rv' \<currency> ?r'2161 threada buffera rv ct cnode rv') (liftxf (?es2161 threada buffera rv ct cnode rv') (?ef'2161 threada buffera rv ct cnode rv') (?vf'2161 threada buffera rv ct cnode rv') (?xf'2161 threada buffera rv ct cnode rv')) (?P2167 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode) (?G'1938 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv') [] (unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv))) (\<acute>lus_ret :== CALL lookupTargetSlot_'proc(lookupCap_ret_C.cap_C rv',ctReceiveIndex_C ct,ctReceiveDepth_C ct))
 2. \<And>threada buffera rv ct cnode rv' rv'a t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2161 threada buffera rv ct cnode rv') rv'a t t' (IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 3. \<And>threada buffera rv ct cnode rv' slot rv'a. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'2161 threada buffera rv ct cnode rv' slot (?vf'2161 threada buffera rv ct cnode rv' rv'a); ?ef'2161 threada buffera rv ct cnode rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 threada buffera rv ct cnode rv' slot) (?Q'2161 threada buffera rv ct cnode rv' slot rv'a) (SKIP # hs) (doE cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 4. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?ef'2161 threada buffera rv ct cnode rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'2161 threada buffera rv ct cnode rv' err (?ef'2161 threada buffera rv ct cnode rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 5. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 6. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'a. ?r'2161 threada buffera rv ct cnode rv' slot (?vf'2161 threada buffera rv ct cnode rv' rv'a)) (?xf'2161 threada buffera rv ct cnode rv') (\<lambda>slot rv'a. {s. ?ef'2161 threada buffera rv ct cnode rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 7. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. ?f'2161 threada buffera rv ct cnode rv' err (?ef'2161 threada buffera rv ct cnode rv' slot)) (?es2161 threada buffera rv ct cnode rv') (\<lambda>slot rv'a. {s. ?ef'2161 threada buffera rv ct cnode rv' (?xf'2161 threada buffera rv ct cnode rv' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 8. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 9. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. ?P2167 threada buffera rv ct a and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 10. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> ?G'1938 threada buffera rv ct cnode (luc_ret_' s)})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (12 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?f2176 threada buffera rv ct cnode rv' \<currency> ?r'2161 threada buffera rv ct cnode rv') (liftxf (?es2161 threada buffera rv ct cnode rv') (?ef'2161 threada buffera rv ct cnode rv') (?vf'2161 threada buffera rv ct cnode rv') (?xf'2161 threada buffera rv ct cnode rv')) (?P2167 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode) (?G'1938 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv') [] (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) (\<acute>lus_ret :== CALL lookupTargetSlot_'proc(lookupCap_ret_C.cap_C rv',ctReceiveIndex_C ct,ctReceiveDepth_C ct))
 2. \<And>threada buffera rv ct cnode rv' rv'a t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2161 threada buffera rv ct cnode rv') rv'a t t' (IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 3. \<And>threada buffera rv ct cnode rv' slot rv'a. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'2161 threada buffera rv ct cnode rv' slot (?vf'2161 threada buffera rv ct cnode rv' rv'a); ?ef'2161 threada buffera rv ct cnode rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 threada buffera rv ct cnode rv' slot) (?Q'2161 threada buffera rv ct cnode rv' slot rv'a) (SKIP # hs) (doE cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 4. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?ef'2161 threada buffera rv ct cnode rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (?ef'2161 threada buffera rv ct cnode rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 5. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 6. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'a. ?r'2161 threada buffera rv ct cnode rv' slot (?vf'2161 threada buffera rv ct cnode rv' rv'a)) (?xf'2161 threada buffera rv ct cnode rv') (\<lambda>slot rv'a. {s. ?ef'2161 threada buffera rv ct cnode rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 7. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (?ef'2161 threada buffera rv ct cnode rv' slot)) (?es2161 threada buffera rv ct cnode rv') (\<lambda>slot rv'a. {s. ?ef'2161 threada buffera rv ct cnode rv' (?xf'2161 threada buffera rv ct cnode rv' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 8. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 9. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. ?P2167 threada buffera rv ct a and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 10. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> ?G'1938 threada buffera rv ct cnode (luc_ret_' s)})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (11 subgoals):
 1. \<And>threada buffera rv ct cnode rv' rv'a t t'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> lus_ret_' rv'a t t' (IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 2. \<And>threada buffera rv ct cnode rv' slot rv'a. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C rv'a = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 threada buffera rv ct cnode rv' slot) (?Q'2161 threada buffera rv ct cnode rv' slot rv'a) (SKIP # hs) (doE cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 3. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (?d'2161 threada buffera rv ct cnode rv' rv'a)
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 5. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 6. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 7. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 9. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 10. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot rv'a. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C rv'a = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 threada buffera rv ct cnode rv' slot) (?Q'2161 threada buffera rv ct cnode rv' slot rv'a) (SKIP # hs) (doE cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot slot_c. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 threada buffera rv ct cnode rv' slot) (?Q'2161 threada buffera rv ct cnode rv' slot slot_c) (SKIP # hs) (doE cte <- liftE (getCTE slot);
y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) (IF lookupSlot_ret_C.status_C slot_c \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C slot_c;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot slot_c. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' slot) (?Q'2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' slot slot_c) (SKIP # hs) (do cte <- getCTE slot;
doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE
od) (\<acute>slot :== cte_Ptr slot;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q'2161 threada buffera rv ct cnode rv' slot rv'a})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot slot_c. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?Q2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' slot) (?G'2381 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' slot slot_c) (SKIP # hs) (do cte <- getCTE slot;
doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. cte_Ptr slot)))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>?Q2161 threada buffera rv ct cnode rv'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> ?G'2381 threada buffera rv ct cnode rv' slot rv'a}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot slot_c. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' (\<lambda>_. True) slot and no_0_obj') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. cte_Ptr slot)) {},{s. \<exists>(rv, \<sigma>')\<in>fst ((do cte <- getCTE slot;
doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE
od) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd []) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd xs) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL))}
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>threada buffera rv ct cnode rv' slot slot_c \<sigma>. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' (\<lambda>_. True) slot and no_0_obj') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c cte_Ptr slot \<and> (\<forall>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((do cte <- getCTE slot;
doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE
od) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))), ret__ptr_to_struct_cte_C_' := NULL, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> True | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> xs = []))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((do cte <- getCTE slot;
doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE
od) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) cap_null_cap, ret__ptr_to_struct_cte_C_' := cte_Ptr slot, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> cte_Ptr slot = NULL | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs = []) = (cte_Ptr slot = NULL) \<and> (xs \<noteq> [] \<longrightarrow> cte_Ptr slot = cte_Ptr (hd xs) \<and> cte_Ptr slot \<noteq> NULL)))))}
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' slot slot_c \<sigma> x cte. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot; ctReceiveDepth rv \<le> word_bits; ctes_of \<sigma> slot = Some cte; no_0_obj' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr slot \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>a b. (a, b) \<in> fst ((doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) \<sigma>) \<and> (b, x) \<in> rf_sr \<and> (\<forall>xs. a = Inr xs \<longrightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> xs = []))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>a b. (a, b) \<in> fst ((doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) \<sigma>) \<and> (b, x) \<in> rf_sr \<and> (case a of Inl x \<Rightarrow> cte_Ptr slot = NULL | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs = []) = (cte_Ptr slot = NULL) \<and> (xs \<noteq> [] \<longrightarrow> cte_Ptr slot = cte_Ptr (hd xs) \<and> cte_Ptr slot \<noteq> NULL)))))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' slot slot_c \<sigma> x cte y'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = cte_Ptr slot; ctReceiveDepth rv \<le> word_bits; ctes_of \<sigma> slot = Some cte; no_0_obj' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> slot = Some cte; ccte_relation cte y'; cslift x (cte_Ptr slot) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr slot \<and> ((\<exists>t. ret__unsigned_' t = cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])))) \<longrightarrow> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>a b. (a, b) \<in> fst ((doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) \<sigma>) \<and> (b, x) \<in> rf_sr \<and> (\<forall>xs. a = Inr xs \<longrightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> xs = []))) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals x))) (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>a b. (a, b) \<in> fst ((doE y <- unlessE (cteCap cte = capability.NullCap) (throwError ());
returnOk [slot]
odE) \<sigma>) \<and> (b, x) \<in> rf_sr \<and> (case a of Inl x \<Rightarrow> cte_Ptr slot = NULL | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs = []) = (cte_Ptr slot = NULL) \<and> (xs \<noteq> [] \<longrightarrow> cte_Ptr slot = cte_Ptr (hd xs) \<and> cte_Ptr slot \<noteq> NULL)))))
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' slot_c \<sigma> x cte y' t. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C slot_c = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.slot_C slot_c = NULL; ctReceiveDepth rv \<le> word_bits; no_0_obj' \<sigma>; (\<sigma>, x) \<in> rf_sr; ctes_of \<sigma> 0 = Some cte; cslift x NULL = Some y'; ccap_relation capability.NullCap (cte_C.cap_C y'); ret__unsigned_' t = cap_get_tag (cte_C.cap_C y'); cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (9 subgoals):
 1. \<And>threada buffera rv ct cnode rv' err rv'a err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupSlot_ret_C.status_C rv'a) err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 threada buffera rv ct cnode rv' err) (?Q''2161 threada buffera rv ct cnode rv' err rv'a err') (SKIP # hs) (throwError err) (IF lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 4. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 5. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 8. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 9. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (9 subgoals):
 1. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' ()) (?Q''2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') (SKIP # hs) (throwError ()) (return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL);;
(\<acute>slot :== lookupSlot_ret_C.slot_C rv'a;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_'))))
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 4. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?Q''2161 threada buffera rv ct cnode rv' err slot rv'a})
 5. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 8. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 9. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE2161 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' ()) (?P'2576 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') (SKIP # hs) (throwError ()) (return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL))
 2. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2575 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>?QE2161 threada buffera rv ct cnode rv'\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> ?P'2576 threada buffera rv ct cnode rv' err slot rv'a \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd []) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd xs) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL))}
 2. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2575 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (10 subgoals):
 1. \<And>rv ct cnode rv' rv'a err' \<sigma>. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError () \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_struct_cte_C_' := NULL, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (NULL \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> NULL = cte_Ptr (hd []) \<and> NULL \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (NULL \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> NULL = cte_Ptr (hd xs) \<and> NULL \<noteq> NULL))}
 2. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2575 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 5. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 6. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 8. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 9. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 10. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (9 subgoals):
 1. \<And>rv ct cnode rv' rv'a err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2575 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rv'a err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 4. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 5. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 7. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 8. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 9. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (8 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupTargetSlot cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a. cte_wp_at' (\<lambda>_. True) a and no_0_obj'\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 3. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 4. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 7. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 8. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (8 subgoals):
 1. \<And>rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R2165 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode\<rbrace> unifyFailure (lookupSlotForCNodeOp False cnode (ctReceiveIndex rv) (ctReceiveDepth rv)) \<lbrace>\<lambda>a b. cte_wp_at' (\<lambda>_. True) a b \<and> no_0_obj' b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 3. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 4. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and ?R2165 threada buffera rv ct a\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 6. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 7. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 8. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (7 subgoals):
 1. \<And>threada buffera rv ct cnode rv'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot rv'. lookupSlot_ret_C.slot_C rv' = cte_Ptr slot \<and> ctReceiveDepth rv \<le> word_bits) lus_ret_' (\<lambda>slot rv'. {s. lookupSlot_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr slot) s \<in> UNIV}})
 2. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 3. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 5. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 6. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 7. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>threada buffera rv ct cnode rv' err. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>slot. dc (lookupSlot_ret_C.status_C slot)) errstate (\<lambda>slot rv'a. {s. lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> s \<in> UNIV \<inter> ?R'2575 threada buffera rv ct cnode rv' err slot rv'a})
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>rv ct cnode rv' s rva. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; ccap_relation cnode (lookupCap_ret_C.cap_C rv'); lookupCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; lookupSlot_ret_C.status_C (lus_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> s \<in> ?R'2575 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct cnode rv' () rva (errstate s)
 2. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (5 subgoals):
 1. \<And>threada buffera rv ct err rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (lookupCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 threada buffera rv ct err) (?Q''1616 threada buffera rv ct err rv' err') (SKIP # hs) (throwError err) (IF lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 4. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 5. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (5 subgoals):
 1. \<And>threada buffera rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct ()) (?Q''1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') (SKIP # hs) (throwError ()) (return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL);;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 4. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 5. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (5 subgoals):
 1. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct ()) (?Q''1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') (SKIP # hs) (throwError ()) (return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL);;
(\<acute>cnode :== lookupCap_ret_C.cap_C rv';;
(\<acute>lus_ret :== CALL lookupTargetSlot_'proc(\<acute>cnode,ctReceiveIndex_C ct,ctReceiveDepth_C ct);;
(IF lookupSlot_ret_C.status_C \<acute>lus_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
(\<acute>slot :== lookupSlot_ret_C.slot_C \<acute>lus_ret;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C'']))));;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL)
FI;;
return_C ret__ptr_to_struct_cte_C_'_update slot_')))))))
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''1616 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 4. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 5. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (c \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> c = cte_Ptr (hd []) \<and> c \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (c \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> c = cte_Ptr (hd xs) \<and> c \<noteq> NULL)) ret__ptr_to_struct_cte_C_' (?QE1616 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct ()) (?P'2645 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') (SKIP # hs) (throwError ()) (return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL))
 2. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2644 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>?QE1616 threada buffera rv ct\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?P'2645 threada buffera rv ct err (luc_ret_' s) (errstate s) \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd []) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (ret__ptr_to_struct_cte_C_' s \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> ret__ptr_to_struct_cte_C_' s = cte_Ptr (hd xs) \<and> ret__ptr_to_struct_cte_C_' s \<noteq> NULL))}
 2. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2644 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (6 subgoals):
 1. \<And>rv ct rv' err' \<sigma>. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError () \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_struct_cte_C_' := NULL, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (case rv of Inl x \<Rightarrow> ([] = [] \<or> (\<exists>slot. [] = [slot])) \<and> ([] \<noteq> []) = (NULL \<noteq> NULL) \<and> ([] \<noteq> [] \<longrightarrow> NULL = cte_Ptr (hd []) \<and> NULL \<noteq> NULL) | Inr xs \<Rightarrow> (xs = [] \<or> (\<exists>slot. xs = [slot])) \<and> (xs \<noteq> []) = (NULL \<noteq> NULL) \<and> (xs \<noteq> [] \<longrightarrow> NULL = cte_Ptr (hd xs) \<and> NULL \<noteq> NULL))}
 2. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2644 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 5. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 6. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (5 subgoals):
 1. \<And>rv ct rv' err'. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct; lookupCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2644 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv ct () rv' err') return_C ret__ptr_to_struct_cte_C_'_update (\<lambda>a. NULL) {},UNIV
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 4. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 5. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (4 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 threada buffera rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a. (\<lambda>b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits) and (\<lambda>b. True \<and> True \<and> (valid_objs' and valid_cap' a) b \<and> no_0_obj' b)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 3. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 4. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (4 subgoals):
 1. \<And>rv ct. \<lbrakk>buffer \<noteq> 0; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<lbrace>?R1626 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) rv\<rbrace> unifyFailure (lookupCap thread (ctReceiveRoot rv)) \<lbrace>\<lambda>a b. valid_pspace' b \<and> valid_cap' a b \<and> ctReceiveDepth rv < 2 ^ word_bits \<and> valid_objs' b \<and> valid_cap' a b \<and> no_0_obj' b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 3. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and ?R1626 threada buffera a\<rbrace>
 4. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (3 subgoals):
 1. \<And>threada buffera rv ct. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; cct_relation rv ct\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1616 threada buffera rv ct\<^esub> (?R'1623 rv ct) \<acute>luc_ret :== CALL lookupCap_'proc(tcb_ptr_to_ctcb_ptr thread,ctReceiveRoot_C ct) {s. (lookupCap_ret_C.status_C (luc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (luc_ret_' s)) \<longrightarrow> s \<in> {sa. cnode_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa \<in> {sa. depth_'_update (\<lambda>_. ctReceiveDepth_C ct) (capptr_'_update (\<lambda>_. ctReceiveIndex_C ct) (root_'_update (\<lambda>_. lookupCap_ret_C.cap_C (luc_ret_' s)) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>capptr = ctReceiveIndex rv\<rbrace> \<inter> \<lbrace>ccap_relation cnode \<acute>root\<rbrace> \<inter> \<lbrace>\<acute>depth = word_of_nat (ctReceiveDepth rv)\<rbrace>}})) \<and> (lookupCap_ret_C.status_C (luc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (lookupCap_ret_C.status_C (luc_ret_' s)) (errstate s) \<longrightarrow> s \<in> UNIV \<inter> ?R'2644 threada buffera rv ct err (luc_ret_' s) (errstate s)))}
 2. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and (\<lambda>b. True \<and> valid_pspace' b \<and> True \<and> valid_objs' b \<and> ctReceiveDepth a < 2 ^ word_bits \<and> valid_objs' b \<and> valid_objs' b \<and> no_0_obj' b)\<rbrace>
 3. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> ?R'1621 threada buffera t rv}}
flex-flex pairs:
\<lambda>t rv. ?R'1623 rv (ret__struct_cap_transfer_C_' t) \<equiv>\<^sup>? ?R'1621 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (2 subgoals):
 1. \<And>threada buffera. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer\<rbrakk> \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a. valid_pspace' and tcb_at' thread and (\<lambda>b. True \<and> valid_pspace' b \<and> True \<and> valid_objs' b \<and> ctReceiveDepth a < 2 ^ word_bits \<and> valid_objs' b \<and> valid_objs' b \<and> no_0_obj' b)\<rbrace>
 2. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> {s. \<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta)) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta)) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> (\<forall>err. luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 threada buffera t rv s ta err))}}}
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (2 subgoals):
 1. buffer \<noteq> 0 \<Longrightarrow> \<lbrace>?R932 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer)\<rbrace> loadCapTransfer buffer \<lbrace>\<lambda>a b. valid_pspace' b \<and> tcb_at' thread b \<and> valid_pspace' b \<and> valid_objs' b \<and> ctReceiveDepth a < 2 ^ word_bits \<and> valid_objs' b \<and> no_0_obj' b\<rbrace>
 2. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and ?R932 threada buffera) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> {s. \<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta)) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta)) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> (\<forall>err. luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 threada buffera t rv s ta err))}}}
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>threada buffera s s'. \<lbrakk>buffer \<noteq> 0; threada = tcb_ptr_to_ctcb_ptr thread; buffera = PTR(32 word) buffer; (s, s') \<in> rf_sr; (valid_ipc_buffer_ptr' buffer and valid_pspace' and tcb_at' thread) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' buffer and (\<lambda>a. valid_pspace' a \<and> tcb_at' thread a \<and> valid_pspace' a \<and> valid_objs' a \<and> True \<and> valid_objs' a \<and> no_0_obj' a)) s \<and> s' \<in> {s. buffer_'_update (\<lambda>_. buffera) s \<in> UNIV \<inter> \<lbrace>\<acute>buffer = buffera\<rbrace>} \<inter> {s'. \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) s \<in> {s. cPtr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (thread_'_update (\<lambda>_. threada) s) \<in> UNIV \<inter> \<lbrace>\<acute>cPtr = ctReceiveRoot rv\<rbrace> \<inter> \<lbrace>\<acute>thread = threada\<rbrace>} \<inter> {s. \<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta)) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv))) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta)) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> (\<forall>err. luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 threada buffera t rv s ta err))}}}
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> valid_objs' s \<and> no_0_obj' s \<and> (\<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ())))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (3 subgoals):
 1. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> no_0_obj' s
 3. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> no_0_obj' s
 2. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s\<rbrakk> \<Longrightarrow> \<forall>t rv. cct_relation rv (ret__struct_cap_transfer_C_' t) \<longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s; cct_relation rv (ret__struct_cap_transfer_C_' t)\<rbrakk> \<Longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t rv. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s; case rv of CT croot idx dpt \<Rightarrow> ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = croot \<and> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = idx \<and> unat (ctReceiveDepth_C (ret__struct_cap_transfer_C_' t)) = dpt\<rbrakk> \<Longrightarrow> cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>)) \<in> (if ctReceiveRoot_C (ret__struct_cap_transfer_C_' t) = ctReceiveRoot rv then UNIV else {}) \<and> (\<forall>ta. (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cnode. ccap_relation cnode (lookupCap_ret_C.cap_C (ret__struct_lookupCap_ret_C_' ta))) \<longrightarrow> ctReceiveIndex_C (ret__struct_cap_transfer_C_' t) = ctReceiveIndex rv \<and> ctReceiveDepth_C (ret__struct_cap_transfer_C_' t) = word_of_nat (ctReceiveDepth rv)) \<and> (lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t rv (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()))
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal (1 subgoal):
 1. \<And>s s' t ta. \<lbrakk>buffer \<noteq> 0; (s, s') \<in> rf_sr; valid_ipc_buffer_ptr' buffer s; valid_pspace' s; tcb_at' thread s; lookupCap_ret_C.status_C (ret__struct_lookupCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s'\<lparr>ct_' := ret__struct_cap_transfer_C_' t, cptr_' := ctReceiveRoot_C (ret__struct_cap_transfer_C_' t), globals := globals t\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>) \<in> ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) t (CT (ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ctReceiveIndex_C (ret__struct_cap_transfer_C_' t)) (unat (ctReceiveDepth_C (ret__struct_cap_transfer_C_' t)))) (cptr_'_update (\<lambda>_. ctReceiveRoot_C (ret__struct_cap_transfer_C_' t)) (ct_'_update (\<lambda>_. ret__struct_cap_transfer_C_' t) (s'\<lparr>globals := globals t\<rparr>))) ta ()
flex-flex pairs:
\<lambda>t rv s ta err. ?R'2752 rv (ret__struct_cap_transfer_C_' t) err (ret__struct_lookupCap_ret_C_' ta) (errstate (luc_ret_'_update (\<lambda>_. ret__struct_lookupCap_ret_C_' ta) (s\<lparr>globals := globals s\<lparr>current_lookup_fault_' := current_lookup_fault_' (globals ta), ghost'state_' := ghost'state_' (globals ta)\<rparr>\<rparr>))) \<equiv>\<^sup>? ?R'2751 (tcb_ptr_to_ctcb_ptr thread) (PTR(32 word) buffer) proof (prove)
goal:
No subgoals!