theory Ipc_C

lemma transferCapsLoop_ccorres:
  assumes conds:
    "rcv_buffer \<noteq> 0"
    "ep \<noteq> Some 0"
  defines "check1 \<equiv>
    Guard ShiftError \<lbrace>0 <=s seL4_MsgExtraCapBits\<rbrace>
     (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace>
       (\<acute>ret__int :==
          (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1
           else 0)))"
      and "check2 \<equiv> \<lambda>caps.
    IF \<acute>ret__int \<noteq> 0 THEN
      Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :==
        (if index (excaprefs_C caps) (unat \<acute>i) \<noteq> cte_Ptr 0 then 1
         else 0))
    FI"
  defines "W \<equiv> \<lambda>ep caps.
           check1;; check2 caps;;
           (While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>
             (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== index (excaprefs_C caps) (unat \<acute>i));;
              Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>slot\<rbrace>
               (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
              \<acute>ret__unsigned :== CALL cap_get_capType(\<acute>cap);;
              \<acute>ret__int :== (if \<acute>ret__unsigned = scast cap_endpoint_cap then 1 else 0);;
              IF \<acute>ret__int \<noteq> 0 THEN
                \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr(\<acute>cap);;
                \<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
              FI;;
              IF \<acute>ret__int \<noteq> 0 THEN
                \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge(\<acute>cap);;
                CALL setExtraBadge(Ptr rcv_buffer, ucast \<acute>ret__unsigned,\<acute>i);;
                \<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped(\<acute>info);;
                Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 <=s (1 :: sword32)\<rbrace>
                 (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped(\<acute>info,
                  \<acute>ret__unsigned || scast ((1 :: sword32) << unat \<acute>i)))
              ELSE
                lvar_nondet_init dc_ret_' dc_ret_'_update;;
                IF \<acute>destSlot = cte_Ptr 0 THEN
                  break_C
                FI;;
                \<acute>dc_ret :== CALL deriveCap(\<acute>slot,\<acute>cap);;
                IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> scast EXCEPTION_NONE THEN
                  break_C
                FI;;
                \<acute>ret__unsigned :== CALL cap_get_capType(deriveCap_ret_C.cap_C \<acute>dc_ret);;
                IF \<acute>ret__unsigned = scast cap_null_cap THEN
                  break_C
                FI;;
                CALL cteInsert(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
                \<acute>destSlot :== cte_Ptr 0
              FI;;
              \<acute>i :== \<acute>i + 1;; check1;; check2 caps))"
  defines "precond n mi slots \<equiv> (UNIV \<inter> \<lbrace>\<acute>i = of_nat n\<rbrace>
                 \<inter> \<lbrace>mi = message_info_to_H (\<acute>info)\<rbrace>
                 \<inter> \<lbrace>\<acute>destSlot = (if slots = [] then NULL else cte_Ptr (hd slots))
                                \<and> length slots \<le> 1 \<and> slots \<noteq> [0]\<rbrace>)"
  defines "is_the_ep \<equiv> \<lambda>cap. isEndpointCap cap \<and> ep \<noteq> None \<and> capEPPtr cap = the ep"
  defines "stable_masked \<equiv> \<lambda>scap excap. excap \<noteq> scap \<longrightarrow> excap = maskedAsFull scap scap"
  defines "relative_at  \<equiv> \<lambda>scap slot s. cte_wp_at'
                                 (\<lambda>cte. badge_derived' scap (cteCap cte) \<and>
                                        capASID scap = capASID (cteCap cte) \<and>
                                        cap_asid_base' scap = cap_asid_base' (cteCap cte) \<and>
                                        cap_vptr' scap = cap_vptr' (cteCap cte)) slot s"
  shows "drop n (interpret_excaps caps') = excaps_map caps
            \<and> n \<le> length (interpret_excaps caps')
         \<Longrightarrow> ccorresG rf_sr \<Gamma>
           (\<lambda>r (i, info). r = msgExtraCaps_update (\<lambda>_. i) (message_info_to_H info)
                       \<and> i \<le> 3) (\<lambda>s. (i_' s, info_' s))
           (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and
           (\<lambda>s.  (\<forall>x \<in> set caps. s \<turnstile>' fst x
             \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte)
               \<longrightarrow> (fst x) =  (cteCap cte)) (snd x) s
             \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> NullCap  \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s)) and
           (\<lambda>s. \<forall> sl \<in> (set slots). cte_wp_at' (isNullCap o cteCap) sl s) and
           (\<lambda>_. n + length caps \<le> 3 \<and> distinct slots ))
           (precond n mi slots)
           [catchbrk_C]
           (transferCapsToSlots ep rcv_buffer n caps slots mi)
           (W ep caps')" unfolding W_def check1_def check2_def split_def proof (rule ccorres_gen_asm, induct caps arbitrary: n slots mi) note if_split[split] case Nil thus ?case apply (simp only: transferCapsToSlots.simps) apply (rule ccorres_guard_imp2) apply (rule ccorres_Guard_Seq ccorres_rhs_assoc)+ apply (rule ccorres_rhs_assoc2, rule ccorres_symb_exec_r) apply (rule ccorres_expand_while_iff [THEN iffD1]) apply (rule ccorres_cond_false) apply (rule_tac P="\<lambda>_. n \<le> 3" and P'="\<lbrace>\<acute>i=of_nat n \<and> mi=message_info_to_H \<acute>info\<rbrace>"
                 in ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def msgExtraCapBits_def word_le_nat_alt unat_of_nat) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (simp add: seL4_MsgExtraCapBits_def) apply (clarsimp simp: excaps_map_def seL4_MsgExtraCapBits_def word_sle_def precond_def) apply (subst interpret_excaps_test_null; clarsimp simp: unat_of_nat elim!: le_neq_trans) done next note if_split[split] case (Cons x xs') let ?S="\<lbrace>\<acute>i=of_nat n \<and> mi=message_info_to_H \<acute>info\<rbrace>" have n3: "n \<le> 3" using Cons.prems by simp hence of_nat_n3[intro!]: "of_nat n \<le> (3 :: word32)" by (simp add: word_le_nat_alt unat_of_nat) have drop_n_foo: "\<And>xs n y ys. drop n xs = y # ys
     \<Longrightarrow> \<exists>xs'. length xs' = n \<and> xs = xs' @ (y # ys)" apply (frule_tac f=length in arg_cong, simp(no_asm_use)) apply (cut_tac n=n and xs=xs in append_take_drop_id) apply (rule_tac x="take n xs" in exI) apply simp done have ep_cap_not_null: "\<And>cap. isEndpointCap cap \<Longrightarrow> cap \<noteq> NullCap" by (clarsimp simp: isCap_simps) have is_the_ep_maskedAsFull[simp]:"\<And>a b. is_the_ep (maskedAsFull a b) = is_the_ep a" apply (case_tac a) apply (simp add:maskedAsFull_def is_the_ep_def isCap_simps)+ done have is_the_ep_fold:
  "(isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
    = is_the_ep (fst x)" by (simp add:is_the_ep_def) have relative_fold:
   "\<And>scap slot s. (cte_wp_at'
    (\<lambda>cte. badge_derived' scap (cteCap cte) \<and>
    capASID scap = capASID (cteCap cte) \<and>
    cap_asid_base' scap = cap_asid_base' (cteCap cte) \<and>
    cap_vptr' scap = cap_vptr' (cteCap cte)) slot s) = relative_at scap slot s" by (simp add:relative_at_def) have stable_eq:
    "\<And>scap excap. \<lbrakk>stable_masked scap excap; isEndpointCap excap\<rbrakk> \<Longrightarrow> scap = excap" by (simp add:isCap_simps stable_masked_def maskedAsFull_def split:if_splits) have is_the_ep_stable:
    "\<And>a b. \<lbrakk>a \<noteq> NullCap \<longrightarrow> stable_masked a b; \<not> is_the_ep b \<rbrakk> \<Longrightarrow> \<not> is_the_ep a" apply (clarsimp simp:stable_masked_def maskedAsFull_def is_the_ep_def isCap_simps split:if_splits) apply auto done have is_the_ep_maskCapRights:
    "\<And>rights cap. is_the_ep (maskCapRights rights cap) = is_the_ep cap" apply (case_tac "isEndpointCap cap") apply (simp_all add:is_the_ep_def maskCapRights_def) apply (clarsimp simp:isCap_simps) apply (case_tac cap) apply (simp_all add:isCap_simps) apply (rename_tac acap) apply (case_tac acap) apply (clarsimp simp:ARM_H.maskCapRights_def isPageCap_def)+ done have is_the_ep_deriveCap:
  "\<And>slot cap. \<lbrace>\<lambda>s. \<not> (is_the_ep cap)\<rbrace> deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> (is_the_ep rv)\<rbrace>, -" apply (case_tac cap) apply (simp_all add:deriveCap_def Let_def isCap_simps is_the_ep_def) apply (wp,clarsimp)+ defer apply (wp,clarsimp)+ apply (rename_tac acap) apply (case_tac acap) apply (simp_all add:ARM_H.deriveCap_def Let_def isCap_simps is_the_ep_def) apply (wp |clarsimp|rule conjI)+ done have mask_right_eq_null:
    "\<And>r cap. (maskCapRights r cap = NullCap) = (cap = NullCap)" apply (case_tac cap) apply (simp_all add:maskCapRights_def isCap_simps) apply (rename_tac acap) apply (case_tac acap) apply (simp add:ARM_H.maskCapRights_def isPageCap_def)+ done note if_split[split del] note if_cong[cong] note extra_sle_sless_unfolds [simp del] note sle_positive[simp del] from Cons.prems show ?case apply (clarsimp simp: Let_def word_sle_def[where b=5] split_def
                    cong: call_ignore_cong
                simp del: Collect_const) apply (rule ccorres_constOnFailure) apply (rule ccorres_guard_imp2) apply (rule ccorres_symb_exec_r) apply (rule ccorres_expand_while_iff [THEN iffD1]) apply (rule ccorres_cond_true) apply (rule ccorres_rhs_assoc)+ apply (rule_tac xf'=i_' in ccorres_abstract, ceqv) apply (rule ccorres_Guard_Seq) apply csymbr apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=cap_' in ccorres_abstract,ceqv) apply (rename_tac n' cap') apply (rule_tac P="\<exists>acap. ccap_relation acap cap'
                     \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)" in ccorres_gen_asm2) apply csymbr+ apply (rule ccorres_symb_exec_r) apply (rule ccorres_seq_cond_raise[THEN iffD2]) apply (rule_tac xf'=ret__int_' in ccorres_abstract_known, ceqv) apply (rule ccorres_cond2[where R=\<top>]) apply (clarsimp simp: Collect_const_mem) apply (rule sym, rule from_bool_neq_0)

            \<comment> \<open>case where a badge is sent\<close> apply (rule ccorres_rhs_assoc)+ apply csymbr apply (simp only: Let_def liftE_bindE withoutFailure_def fun_app_def) apply (ctac add: setExtraBadge_ccorres) apply (simp only: K_bind_def) apply (rule ccorres_case_sum_liftE) apply (csymbr, rule ccorres_abstract_cleanup) apply (rule ccorres_Guard_Seq) apply (csymbr, rule ccorres_abstract_cleanup) apply (rule ccorres_symb_exec_r) apply (rule ccorres_rhs_assoc2) apply (rule Cons.hyps) apply (clarsimp simp: excaps_map_def dest!: drop_n_foo) apply simp apply vcg apply (rule conseqPre, vcg, clarsimp) apply (wp hoare_vcg_ball_lift) apply (simp split del: if_split) apply (vcg exspec=setExtraBadge_modifies)

           \<comment> \<open>case where a cap is sent (or rather a send is attempted)\<close> apply (simp add: split_def del: Collect_const
                      cong: call_ignore_cong split del: if_split) apply (rule ccorres_rhs_assoc)+ apply csymbr apply wpc apply (rule ccorres_cond_true_seq) apply (simp add: returnOk_liftE) apply (rule ccorres_case_sum_liftE) apply (rule ccorres_split_throws) apply (rule_tac P=\<top> and P'="?S" in ccorres_break_return) apply clarsimp apply simp apply vcg apply (rule ccorres_cond_false_seq) apply (simp)

           \<comment> \<open>case not diminish\<close> apply (rule ccorres_split_nothrowE) apply (rule unifyFailure_ccorres) apply (ctac add: deriveCap_ccorres') apply ceqv apply (simp only: refl not_True_eq_False Collect_False ccorres_seq_simps) apply csymbr apply (rule_tac Q=\<top> and Q'=\<top> in ccorres_split_when_throwError_cond_break) apply (clarsimp simp: cap_get_tag_isCap Collect_const_mem) apply (rule_tac P=\<top> and P'="?S" in ccorres_break) apply clarsimp apply simp apply (simp(no_asm) add: liftE_bindE split del: if_split) apply (ctac add: cteInsert_ccorres) apply (rule ccorres_case_sum_liftE) apply csymbr apply (rule ccorres_symb_exec_r) apply (rule ccorres_rhs_assoc2) apply (rule_tac P="ccorresG rf_sr \<Gamma> r xf Pre Pre' hs a" for r xf Pre Pre' hs a in rsubst) apply (rule Cons.hyps) apply (clarsimp simp: excaps_map_def dest!: drop_n_foo) apply simp apply simp apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (rule cteInsert_assume_Null) apply simp apply (wp cteInsert_valid_pspace hoare_valid_ipc_buffer_ptr_typ_at'
                          hoare_vcg_const_Ball_lift cteInsert_cte_wp_at) apply (vcg exspec=cteInsert_modifies) apply vcg apply (simp) apply (rule ccorres_split_throws) apply (rule_tac P=\<top> and P'="?S" in ccorres_break) apply clarsimp apply simp apply vcg apply wp apply (simp cong: conj_cong) apply (rule_tac Q' ="\<lambda>rcap s. s \<turnstile>' rcap
                 \<and> (rcap\<noteq> NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s)
                 \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1
                 \<and> \<not> is_the_ep rcap
                 \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s)
                 \<and> (\<forall>x\<in>set xs'. s \<turnstile>' fst x
                    \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s
                    \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)"
                 in hoare_post_imp_R) prefer 2 apply (clarsimp simp:cte_wp_at_ctes_of valid_pspace_mdb' valid_pspace'_splits
                   valid_pspace_valid_objs' is_derived_capMasterCap image_def) apply (clarsimp split:if_splits) apply (rule conjI) apply clarsimp+ apply (rule conjI) apply (drule(1) bspec)+ apply (rule conjI | clarsimp)+ apply (clarsimp simp:is_the_ep_def isCap_simps stable_masked_def) apply (drule(1) bspec)+ apply (rule conjI | clarsimp)+ apply (clarsimp simp:is_the_ep_def stable_masked_def split:if_splits)+ apply (case_tac "a = cteCap cteb",clarsimp) apply (simp add:maskedAsFull_def split:if_splits) apply (simp add:maskedAsFull_again) apply (wp deriveCap_derived is_the_ep_deriveCap) apply (vcg exspec=deriveCap_modifies)

          \<comment> \<open>remaining non ccorres subgoals\<close> apply (clarsimp simp: Collect_const_mem if_1_0_0
                     split del: if_split) apply (rule_tac Q'="\<lbrace>\<acute>ret__int = from_bool (cap_get_tag cap' = scast cap_endpoint_cap
                                        \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep)
                  \<and> n' = of_nat n \<and> ((slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))))
                                       \<longrightarrow> ccap_relation (fst x) cap' )
                  \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)\<rbrace>
                    \<inter> precond n mi slots"
              in conseqPost[OF _ _ order_refl]) apply vcg apply (rule subsetI) apply (clarsimp simp: word_of_nat_less from_bool_0 precond_def
                                cap_get_tag_isCap unat_of_nat) apply (rule conjI) apply (clarsimp simp: cap_get_tag_EndpointCap cap_get_tag_isCap[symmetric]
                                 ep_cap_not_null) apply (clarsimp simp: ccap_relation_def map_option_Some_eq2) apply (simp add: message_info_to_H_def word_ao_dist) apply (fold shiftl_1)[1] apply (subst and_mask_eq_iff_shiftr_0[THEN iffD2],
                  subst shiftl_shiftr2, simp, simp) apply (simp add: seL4_MessageInfo_lift_def word_bw_assocs
                              word_sle_def t2n_mask_eq_if) apply (rule conjI) apply (clarsimp simp: ccap_rights_relation_def cap_rights_to_H_def
                                   allRights_def excaps_map_def split_def
                            dest!: drop_n_foo interpret_excaps_eq) apply (clarsimp simp:from_bool_def split:bool.splits) apply (case_tac "isEndpointCap (fst x)") apply (clarsimp simp: cap_get_tag_EndpointCap ep_cap_not_null cap_get_tag_isCap[symmetric]) apply (clarsimp simp: option_to_ptr_def option_to_0_def split:option.splits) apply (clarsimp simp: cap_get_tag_EndpointCap ep_cap_not_null cap_get_tag_isCap[symmetric]) apply (case_tac "ccap_relation (fst x) cap'") apply (simp add:ccap_relation_lift) apply (drule(1) ccap_relation_inject) apply (drule sym[where t = "fst x"]) apply (clarsimp simp:isCap_simps) apply (clarsimp simp: is_the_ep_def ccap_relation_lift isCap_simps) apply (clarsimp simp: option_to_ptr_def option_to_0_def split:option.splits) apply (clarsimp simp:option_to_ptr_def option_to_0_def) apply (case_tac "isEndpointCap (fst x)") apply (clarsimp simp: isCap_simps) apply (drule_tac acap = acap in ccap_relation_inject) apply assumption apply clarsimp apply (clarsimp simp: ccap_relation_def map_option_Some_eq2 split:option.splits) apply (clarsimp simp: cap_endpoint_cap_lift_def option_to_ptr_def
                                option_to_0_def cap_to_H_def Let_def split:cap_CL.splits split:if_splits) apply clarsimp apply (simp only:badge_derived_mask capASID_mask cap_asid_base_mask'
             cap_vptr_mask' maskCap_valid mask_right_eq_null) apply (simp only:is_the_ep_fold relative_fold) apply (clarsimp simp:Collect_const_mem if_1_0_0
             split del:if_split) apply (rule conseqPre, vcg, clarsimp simp: Collect_const_mem) apply (clarsimp simp: if_1_0_0 Collect_const_mem
                              trans[OF eq_commute from_bool_eq_if]
                              from_bool_0
                   split del: if_split simp del: Collect_const) apply vcg apply (simp only:is_the_ep_fold) apply (clarsimp simp:Collect_const_mem if_1_0_0
            split del:if_split) apply (rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (clarsimp split del: if_split
                       simp add: Collect_const[symmetric] precond_def
                       simp del: Collect_const) apply (rule HoarePartial.Seq[rotated] HoarePartial.Cond[OF order_refl]
                  HoarePartial.Basic[OF order_refl] HoarePartial.Skip[OF order_refl]
                  HoarePartial.Guard[OF order_refl])+ apply (simp only:is_the_ep_fold) apply (clarsimp simp:Collect_const_mem if_1_0_0
            split del:if_split) apply (rule conseqPre, vcg, rule subsetI, clarsimp) apply (simp only:is_the_ep_fold) apply (clarsimp simp: Collect_const_mem seL4_MsgExtraCapBits_def
                          word_sle_def if_1_0_0 precond_def
                          msg_max_length_def max_ipc_words word_of_nat_less
                          excaps_map_def unat_of_nat valid_pspace'_def
                          cte_wp_at_ctes_of
                   dest!: drop_n_foo interpret_excaps_eq) apply (frule(1) ctes_of_valid') apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (clarsimp simp: typ_heap_simps' split_def is_the_ep_maskCapRights) apply (frule ccte_relation_ccap_relation) apply (intro conjI impI) apply (intro allI impI) apply clarsimp apply fastforce apply (subgoal_tac "fst x = cteCap cte",simp) apply clarsimp apply (elim disjE) apply (clarsimp simp:ep_cap_not_null stable_masked_def) apply (clarsimp dest!:ccap_relation_lift stable_eq simp: cap_get_tag_isCap) apply (clarsimp simp:valid_cap_simps' isCap_simps) apply (subgoal_tac "slots \<noteq> []") apply simp apply clarsimp apply (elim disjE) apply (clarsimp simp:ep_cap_not_null stable_masked_def) apply (clarsimp dest!:ccap_relation_lift stable_eq simp: cap_get_tag_isCap) apply (clarsimp dest!:ccap_relation_lift simp:cap_get_tag_isCap is_the_ep_def) apply (clarsimp simp:valid_cap_simps' isCap_simps) apply (intro exI conjI,assumption) apply (clarsimp simp: ccap_relation_def map_option_Some_eq2
                            isCap_simps valid_cap_simps')+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps') \<Longrightarrow> ccorres (\<lambda>r (i, info). r = msgExtraCaps_update (\<lambda>_. i) (message_info_to_H info) \<and> i \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s) and (\<lambda>_. n + length caps \<le> 3 \<and> distinct slots)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (W ep caps') proof (prove)
goal (1 subgoal):
 1. drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps') \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s) and (\<lambda>_. n + length caps \<le> 3 \<and> distinct slots)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
goal (2 subgoals):
 1. \<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n [] slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
?P (if ?Q then ?x else ?y) = ((?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y))

goal (2 subgoals):
 1. \<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n [] slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps')
n + length [] \<le> 3 \<and> distinct slots

goal (2 subgoals):
 1. \<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n [] slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
using this:
drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps')
n + length [] \<le> 3 \<and> distinct slots

goal (1 subgoal):
 1. ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n [] slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q2 ?Q'2 [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q2 s \<and> s' \<in> ?Q'2 proof (prove)
goal (2 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q2 ?C'9 [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q2 s \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q2 ?Q'13 [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ?Q'13
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; ?Q2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q2 s \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q2 ?Q'13 [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)
FI)
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ?Q'13
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; ?Q2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q2 s \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q2 ?R'20 [catchbrk_C] (return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) SKIP
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (?R'20 \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; ?Q2 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q2 s \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. n \<le> 3 \<and> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} SKIP {s. \<exists>(rv, \<sigma>')\<in>fst ((return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> rv = msgExtraCaps_update (\<lambda>_. fst (i_' s, info_' s)) (message_info_to_H (snd (i_' s, info_' s))) \<and> fst (i_' s, info_' s) \<le> 3}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (\<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; n \<le> 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> n \<le> 3 \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma>. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> {s. n \<le> 3 \<and> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst ((return $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> rv = msgExtraCaps_update (\<lambda>_. fst (i_' s, info_' s)) (message_info_to_H (snd (i_' s, info_' s))) \<and> fst (i_' s, info_' s) \<le> 3}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (\<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; n \<le> 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> n \<le> 3 \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?C'9 \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (\<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 2. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; n \<le> 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'9 \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> n \<le> 3 \<and> s' \<in> ?C'9 \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; n \<le> 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>((if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i < 3 \<and> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0) = 0) \<and> (\<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> \<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> n \<le> 3 \<and> s' \<in> \<lbrace>((if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i < 3 \<and> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0) = 0) \<and> (\<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> \<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0)\<rbrace> \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n + length [] \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s; s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> n \<le> 3 \<and> s' \<in> \<lbrace>((if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i < 3 \<and> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0) = 0) \<and> (\<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0 \<longrightarrow> \<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info \<and> \<not> (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0) \<noteq> 0)\<rbrace> \<inter> \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map [] \<and> n \<le> length (interpret_excaps caps'); n \<le> 3 \<and> distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> (i_' s' < 3 \<longrightarrow> i_' s' = word_of_nat n \<and> mi = message_info_to_H (info_' s') \<and> excaprefs_C caps'.[unat (i_' s')] = NULL) \<and> (\<not> i_' s' < 3 \<longrightarrow> i_' s' = word_of_nat n \<and> mi = message_info_to_H (info_' s')) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; length (interpret_excaps caps') \<le> 3; distinct slots; valid_pspace' s; i_' s' = word_of_nat (length (interpret_excaps caps')); valid_ipc_buffer_ptr' rcv_buffer s; \<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s; mi = message_info_to_H (info_' s'); destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; word_of_nat (length (interpret_excaps caps')) < 3; n = length (interpret_excaps caps')\<rbrakk> \<Longrightarrow> excaprefs_C caps'.[unat (word_of_nat (length (interpret_excaps caps')))] = NULL proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set []. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n [] slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
?P (if ?Q then ?x else ?y) = ((?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y))

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
\<lbrakk>drop ?n1 (interpret_excaps caps') = excaps_map xs' \<and> ?n1 \<le> length (interpret_excaps caps'); ?n1 + length xs' \<le> 3 \<and> distinct ?slots1\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. ?slots1 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set ?slots1. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond ?n1 ?mi1 ?slots1) [catchbrk_C] (transferCapsToSlots ep rcv_buffer ?n1 xs' ?slots1 ?mi1) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
drop n (interpret_excaps caps') = excaps_map (x # xs') \<and> n \<le> length (interpret_excaps caps')
n + length (x # xs') \<le> 3 \<and> distinct slots

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. n \<le> 3 proof (prove)
using this:
drop n (interpret_excaps caps') = excaps_map (x # xs') \<and> n \<le> length (interpret_excaps caps')
n + length (x # xs') \<le> 3 \<and> distinct slots

goal (1 subgoal):
 1. n \<le> 3 proof (state)
this:
n \<le> 3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
using this:
n \<le> 3

goal (1 subgoal):
 1. word_of_nat n \<le> 3 proof (state)
this:
word_of_nat n \<le> 3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>xs n y ys. drop n xs = y # ys \<Longrightarrow> \<exists>xs'. length xs' = n \<and> xs = xs' @ y # ys proof (prove)
goal (1 subgoal):
 1. \<And>xs n y ys. \<lbrakk>drop n xs = y # ys; length xs - n = Suc (length ys)\<rbrakk> \<Longrightarrow> \<exists>xs'. length xs' = n \<and> xs = xs' @ y # ys proof (prove)
goal (1 subgoal):
 1. \<And>xs n y ys. \<lbrakk>drop n xs = y # ys; length xs - n = Suc (length ys); take n xs @ drop n xs = xs\<rbrakk> \<Longrightarrow> \<exists>xs'. length xs' = n \<and> xs = xs' @ y # ys proof (prove)
goal (1 subgoal):
 1. \<And>xs n y ys. \<lbrakk>drop n xs = y # ys; length xs - n = Suc (length ys); take n xs @ drop n xs = xs\<rbrakk> \<Longrightarrow> length (take n xs) = n \<and> xs = take n xs @ y # ys proof (prove)
goal:
No subgoals! proof (state)
this:
drop ?n2 ?xs2 = ?y2 # ?ys2 \<Longrightarrow> \<exists>xs'. length xs' = ?n2 \<and> ?xs2 = xs' @ ?y2 # ?ys2

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>cap. isEndpointCap cap \<Longrightarrow> cap \<noteq> capability.NullCap proof (state)
this:
isEndpointCap ?cap3 \<Longrightarrow> ?cap3 \<noteq> capability.NullCap

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>a b. is_the_ep (maskedAsFull a b) = is_the_ep a proof (prove)
goal (12 subgoals):
 1. \<And>a b x1. a = capability.ThreadCap x1 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 2. \<And>a b. a = capability.NullCap \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 3. \<And>a b x31 x32 x33 x34. a = capability.NotificationCap x31 x32 x33 x34 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 4. \<And>a b x4. a = capability.IRQHandlerCap x4 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 5. \<And>a b x51 x52 x53 x54 x55 x56. a = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 6. \<And>a b. a = capability.DomainCap \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 7. \<And>a b x71 x72 x73. a = capability.Zombie x71 x72 x73 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 8. \<And>a b x8. a = capability.ArchObjectCap x8 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 9. \<And>a b x91 x92 x93. a = capability.ReplyCap x91 x92 x93 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
 10. \<And>a b x101 x102 x103 x104. a = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> is_the_ep (maskedAsFull a b) = is_the_ep a
A total of 12 subgoals... proof (prove)
goal:
No subgoals! proof (state)
this:
is_the_ep (maskedAsFull ?a3 ?b3) = is_the_ep ?a3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) = is_the_ep (fst x) proof (state)
this:
(isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) = is_the_ep (fst x)

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>scap slot s. cte_wp_at' (\<lambda>cte. badge_derived' scap (cteCap cte) \<and> capASID scap = capASID (cteCap cte) \<and> cap_asid_base' scap = cap_asid_base' (cteCap cte) \<and> cap_vptr' scap = cap_vptr' (cteCap cte)) slot s = relative_at scap slot s proof (state)
this:
cte_wp_at' (\<lambda>cte. badge_derived' ?scap3 (cteCap cte) \<and> capASID ?scap3 = capASID (cteCap cte) \<and> cap_asid_base' ?scap3 = cap_asid_base' (cteCap cte) \<and> cap_vptr' ?scap3 = cap_vptr' (cteCap cte)) ?slot3 ?s3 = relative_at ?scap3 ?slot3 ?s3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>scap excap. \<lbrakk>stable_masked scap excap; isEndpointCap excap\<rbrakk> \<Longrightarrow> scap = excap proof (state)
this:
\<lbrakk>stable_masked ?scap3 ?excap3; isEndpointCap ?excap3\<rbrakk> \<Longrightarrow> ?scap3 = ?excap3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>a b. \<lbrakk>a \<noteq> capability.NullCap \<longrightarrow> stable_masked a b; \<not> is_the_ep b\<rbrakk> \<Longrightarrow> \<not> is_the_ep a proof (prove)
goal (1 subgoal):
 1. \<And>v2 v3 v4 v5 y. \<lbrakk>(\<forall>v2a. v2 = (\<not> v2a)) \<or> (\<forall>v3a. v3 = (\<not> v3a)) \<or> (\<forall>v4a. v4 = (\<not> v4a)) \<or> (\<forall>v5a. v5 = (\<not> v5a)); ep = Some y\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?a3 \<noteq> capability.NullCap \<longrightarrow> stable_masked ?a3 ?b3; \<not> is_the_ep ?b3\<rbrakk> \<Longrightarrow> \<not> is_the_ep ?a3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>rights cap. is_the_ep (global.maskCapRights rights cap) = is_the_ep cap proof (prove)
goal (2 subgoals):
 1. \<And>rights cap. isEndpointCap cap \<Longrightarrow> is_the_ep (global.maskCapRights rights cap) = is_the_ep cap
 2. \<And>rights cap. \<not> isEndpointCap cap \<Longrightarrow> is_the_ep (global.maskCapRights rights cap) = is_the_ep cap proof (prove)
goal (2 subgoals):
 1. \<And>rights cap. isEndpointCap cap \<Longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> (isEndpointCap capability.DomainCap \<and> (\<exists>y. ep = Some y) \<and> capEPPtr capability.DomainCap = the ep) = ((\<exists>y. ep = Some y) \<and> capEPPtr capability.DomainCap = the ep)) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> (isEndpointCap capability.NullCap \<and> (\<exists>y. ep = Some y) \<and> capEPPtr capability.NullCap = the ep) = ((\<exists>y. ep = Some y) \<and> capEPPtr capability.NullCap = the ep))) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> (isEndpointCap capability.DomainCap \<and> (\<exists>y. ep = Some y) \<and> capEPPtr capability.DomainCap = the ep) = ((\<exists>y. ep = Some y) \<and> capEPPtr capability.DomainCap = the ep)) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> (isEndpointCap capability.NullCap \<and> (\<exists>y. ep = Some y) \<and> capEPPtr capability.NullCap = the ep) = ((\<exists>y. ep = Some y) \<and> capEPPtr capability.NullCap = the ep)) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> (isEndpointCap (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply rights) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant rights) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead rights) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite rights) cap)))) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (capEPCanGrantReply_update (\<lambda>_. capEPCanGrantReply cap \<and> capAllowGrantReply rights) (capEPCanGrant_update (\<lambda>_. capEPCanGrant cap \<and> capAllowGrant rights) (capEPCanReceive_update (\<lambda>_. capEPCanReceive cap \<and> capAllowRead rights) (capEPCanSend_update (\<lambda>_. capEPCanSend cap \<and> capAllowWrite rights) cap)))) = the ep) = ((\<exists>y. ep = Some y) \<and> capEPPtr cap = the ep))))
 2. \<And>rights cap. \<not> isEndpointCap cap \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>rights cap. \<not> isEndpointCap cap \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep))))))))))) proof (prove)
goal (12 subgoals):
 1. \<And>rights cap x1. \<lbrakk>\<not> isEndpointCap cap; cap = capability.ThreadCap x1\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 2. \<And>rights cap. \<lbrakk>\<not> isEndpointCap cap; cap = capability.NullCap\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 3. \<And>rights cap x31 x32 x33 x34. \<lbrakk>\<not> isEndpointCap cap; cap = capability.NotificationCap x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 4. \<And>rights cap x4. \<lbrakk>\<not> isEndpointCap cap; cap = capability.IRQHandlerCap x4\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 5. \<And>rights cap x51 x52 x53 x54 x55 x56. \<lbrakk>\<not> isEndpointCap cap; cap = capability.EndpointCap x51 x52 x53 x54 x55 x56\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 6. \<And>rights cap. \<lbrakk>\<not> isEndpointCap cap; cap = capability.DomainCap\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 7. \<And>rights cap x71 x72 x73. \<lbrakk>\<not> isEndpointCap cap; cap = capability.Zombie x71 x72 x73\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 8. \<And>rights cap x8. \<lbrakk>\<not> isEndpointCap cap; cap = capability.ArchObjectCap x8\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 9. \<And>rights cap x91 x92 x93. \<lbrakk>\<not> isEndpointCap cap; cap = capability.ReplyCap x91 x92 x93\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
 10. \<And>rights cap x101 x102 x103 x104. \<lbrakk>\<not> isEndpointCap cap; cap = capability.UntypedCap x101 x102 x103 x104\<rbrakk> \<Longrightarrow> (isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep))))) \<and> (\<not> isZombie cap \<longrightarrow> (isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (Arch.maskCapRights rights (capCap cap)) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights (capCap cap)) \<noteq> the ep)))))))))) \<and> (\<not> isArchObjectCap cap \<longrightarrow> (isIRQHandlerCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQHandlerCap cap \<longrightarrow> (isIRQControlCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isIRQControlCap cap \<longrightarrow> (isThreadCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isThreadCap cap \<longrightarrow> (isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)))) \<and> (\<not> isCNodeCap cap \<longrightarrow> (isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<longrightarrow> ep = None \<or> capEPPtr (capReplyCanGrant_update (\<lambda>_. capReplyCanGrant cap \<and> capAllowGrant rights) cap) \<noteq> the ep))))) \<and> (\<not> isReplyCap cap \<longrightarrow> (isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<longrightarrow> ep = None \<or> capEPPtr (capNtfnCanReceive_update (\<lambda>_. capNtfnCanReceive cap \<and> capAllowRead rights) (capNtfnCanSend_update (\<lambda>_. capNtfnCanSend cap \<and> capAllowWrite rights) cap)) \<noteq> the ep)))) \<and> (\<not> isNotificationCap cap \<longrightarrow> (isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep)) \<and> (\<not> isUntypedCap cap \<longrightarrow> (cap = capability.DomainCap \<longrightarrow> isEndpointCap capability.DomainCap \<longrightarrow> ep = None \<or> capEPPtr capability.DomainCap \<noteq> the ep) \<and> (cap \<noteq> capability.DomainCap \<longrightarrow> (cap = capability.NullCap \<longrightarrow> isEndpointCap capability.NullCap \<longrightarrow> ep = None \<or> capEPPtr capability.NullCap \<noteq> the ep) \<and> (cap \<noteq> capability.NullCap \<longrightarrow> isEndpointCap undefined \<longrightarrow> ep = None \<or> capEPPtr undefined \<noteq> the ep)))))))))))
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>rights cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights x8 = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights x8) \<noteq> the ep proof (prove)
goal (1 subgoal):
 1. \<And>rights cap acap. cap = capability.ArchObjectCap acap \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep proof (prove)
goal (5 subgoals):
 1. \<And>rights cap acap x11 x12. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep
 2. \<And>rights cap acap. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep
 3. \<And>rights cap acap x31 x32 x33 x34 x35. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep
 4. \<And>rights cap acap x41 x42. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep
 5. \<And>rights cap acap x51 x52. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (\<exists>v0 v1 v2 v3 v4 v5. Arch.maskCapRights rights acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> ep = None \<or> capEPPtr (Arch.maskCapRights rights acap) \<noteq> the ep proof (prove)
goal:
No subgoals! proof (state)
this:
is_the_ep (global.maskCapRights ?rights3 ?cap3) = is_the_ep ?cap3

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>slot cap. \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, - proof (prove)
goal (12 subgoals):
 1. \<And>slot cap x1. cap = capability.ThreadCap x1 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 2. \<And>slot cap. cap = capability.NullCap \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 3. \<And>slot cap x31 x32 x33 x34. cap = capability.NotificationCap x31 x32 x33 x34 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 4. \<And>slot cap x4. cap = capability.IRQHandlerCap x4 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 5. \<And>slot cap x51 x52 x53 x54 x55 x56. cap = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 6. \<And>slot cap. cap = capability.DomainCap \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 7. \<And>slot cap x71 x72 x73. cap = capability.Zombie x71 x72 x73 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 8. \<And>slot cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 9. \<And>slot cap x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
 10. \<And>slot cap x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> \<lbrace>\<lambda>s. \<not> is_the_ep cap\<rbrace> global.deriveCap slot cap \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>cap x1. cap = capability.ThreadCap x1 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ThreadCap x1) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 2. \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 3. \<And>cap x31 x32 x33 x34. cap = capability.NotificationCap x31 x32 x33 x34 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.NotificationCap x31 x32 x33 x34) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 4. \<And>cap x4. cap = capability.IRQHandlerCap x4 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.IRQHandlerCap x4) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 5. \<And>cap x51 x52 x53 x54 x55 x56. cap = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<Longrightarrow> \<lbrace>\<lambda>s. ep = None \<or> x51 \<noteq> the ep\<rbrace> returnOk (capability.EndpointCap x51 x52 x53 x54 x55 x56) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 6. \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.DomainCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 7. \<And>cap x71 x72 x73. cap = capability.Zombie x71 x72 x73 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 8. \<And>slot cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot x8 \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 9. \<And>cap x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 10. \<And>slot cap x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE y <- ensureNoChildren slot;
returnOk (capability.UntypedCap x101 x102 x103 x104)
odE \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
A total of 12 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>slot cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot x8 \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 2. \<And>cap x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 3. \<And>slot cap x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE y <- ensureNoChildren slot;
returnOk (capability.UntypedCap x101 x102 x103 x104)
odE \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 4. \<And>cap x111 x112 x113 x114. cap = capability.CNodeCap x111 x112 x113 x114 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.CNodeCap x111 x112 x113 x114) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 5. \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 2. \<And>slot cap x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> doE y <- ensureNoChildren slot;
returnOk (capability.UntypedCap x101 x102 x103 x104)
odE \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 3. \<And>cap x111 x112 x113 x114. cap = capability.CNodeCap x111 x112 x113 x114 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.CNodeCap x111 x112 x113 x114) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 4. \<lbrace>\<lambda>s. True\<rbrace> returnOk capability.NullCap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 5. \<And>slot cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot x8 \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>slot cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot x8 \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>slot cap acap. cap = capability.ArchObjectCap acap \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>slot cap acap x11 x12. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 2. \<And>slot cap acap. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 3. \<And>slot cap acap x31 x32 x33 x34 x35. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 4. \<And>slot cap acap x41 x42. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 5. \<And>slot cap acap x51 x52. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> Arch.deriveCap slot acap \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>cap acap x11 x12. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12); acap = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 2. \<And>cap acap. \<lbrakk>cap = capability.ArchObjectCap arch_capability.ASIDControlCap; acap = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ArchObjectCap arch_capability.ASIDControlCap) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 3. \<And>cap acap x31 x32 x33 x34 x35. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35); acap = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 None)) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -
 4. \<And>cap acap x41 x42. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.PageTableCap x41 x42); acap = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ((\<exists>a b. x42 = Some (a, b)) \<longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -) \<and> (x42 = None \<longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -)
 5. \<And>cap acap x51 x52. \<lbrakk>cap = capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52); acap = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ((\<exists>y. x52 = Some y) \<longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> returnOk (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -) \<and> (x52 = None \<longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>\<lambda>rv s. (\<forall>v0 v1 v2 v3 v4 v5. rv \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5) \<or> ep = None \<or> capEPPtr rv \<noteq> the ep\<rbrace>, -) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>\<lambda>s. \<not> is_the_ep ?cap3\<rbrace> global.deriveCap ?slot3 ?cap3 \<lbrace>\<lambda>rv s. \<not> is_the_ep rv\<rbrace>, -

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<And>r cap. (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap) proof (prove)
goal (12 subgoals):
 1. \<And>r cap x1. cap = capability.ThreadCap x1 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 2. \<And>r cap. cap = capability.NullCap \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 3. \<And>r cap x31 x32 x33 x34. cap = capability.NotificationCap x31 x32 x33 x34 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 4. \<And>r cap x4. cap = capability.IRQHandlerCap x4 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 5. \<And>r cap x51 x52 x53 x54 x55 x56. cap = capability.EndpointCap x51 x52 x53 x54 x55 x56 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 6. \<And>r cap. cap = capability.DomainCap \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 7. \<And>r cap x71 x72 x73. cap = capability.Zombie x71 x72 x73 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 8. \<And>r cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 9. \<And>r cap x91 x92 x93. cap = capability.ReplyCap x91 x92 x93 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
 10. \<And>r cap x101 x102 x103 x104. cap = capability.UntypedCap x101 x102 x103 x104 \<Longrightarrow> (global.maskCapRights r cap = capability.NullCap) = (cap = capability.NullCap)
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>r cap x8. cap = capability.ArchObjectCap x8 \<Longrightarrow> Arch.maskCapRights r x8 \<noteq> capability.NullCap proof (prove)
goal (1 subgoal):
 1. \<And>r cap acap. cap = capability.ArchObjectCap acap \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap proof (prove)
goal (5 subgoals):
 1. \<And>r cap acap x11 x12. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap
 2. \<And>r cap acap. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap
 3. \<And>r cap acap x31 x32 x33 x34 x35. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap
 4. \<And>r cap acap x41 x42. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap
 5. \<And>r cap acap x51 x52. \<lbrakk>cap = capability.ArchObjectCap acap; acap = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> Arch.maskCapRights r acap \<noteq> capability.NullCap proof (prove)
goal:
No subgoals! proof (state)
this:
(global.maskCapRights ?r3 ?cap3 = capability.NullCap) = (?cap3 = capability.NullCap)

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
?P (if ?Q then ?x else ?y) = ((?Q \<longrightarrow> ?P ?x) \<and> (\<not> ?Q \<longrightarrow> ?P ?y))

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
\<lbrakk>?b = ?c; ?c \<Longrightarrow> ?x = ?u; \<not> ?c \<Longrightarrow> ?y = ?v\<rbrakk> \<Longrightarrow> (if ?b then ?x else ?y) = (if ?c then ?u else ?v)

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
(0 \<le>s 1) = (sint 0 \<le> sint 1)
(0 \<le>s numeral ?n) = (sint 0 \<le> sint (numeral ?n))
(1 \<le>s 0) = (sint 1 \<le> sint 0)
(1 \<le>s numeral ?n) = (sint 1 \<le> sint (numeral ?n))
(numeral ?n \<le>s 0) = (sint (numeral ?n) \<le> sint 0)
(numeral ?n \<le>s 1) = (sint (numeral ?n) \<le> sint 1)
(0 <s 1) = (sint 0 < sint 1)
(0 <s numeral ?n) = (sint 0 < sint (numeral ?n))
(1 <s 0) = (sint 1 < sint 0)
(1 <s numeral ?n) = (sint 1 < sint (numeral ?n))
(numeral ?n <s 0) = (sint (numeral ?n) < sint 0)
(numeral ?n <s 1) = (sint (numeral ?n) < sint 1)

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (state)
this:
\<lbrakk>?a \<le> ?n; ?n \<le> 2 ^ (LENGTH(?'a) - 1) - 1\<rbrakk> \<Longrightarrow> ?a \<le>s ?n

goal (1 subgoal):
 1. \<And>x1 caps n slots mi. \<lbrakk>\<And>n slots mi. \<lbrakk>drop n (interpret_excaps caps') = excaps_map caps \<and> n \<le> length (interpret_excaps caps'); n + length caps \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set caps. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n caps slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)); drop n (interpret_excaps caps') = excaps_map (x1 # caps) \<and> n \<le> length (interpret_excaps caps'); n + length (x1 # caps) \<le> 3 \<and> distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x1 # caps). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x1 # caps) slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (chain)
picking this:
drop n (interpret_excaps caps') = excaps_map (x # xs') \<and> n \<le> length (interpret_excaps caps')
n + length (x # xs') \<le> 3 \<and> distinct slots proof (prove)
using this:
drop n (interpret_excaps caps') = excaps_map (x # xs') \<and> n \<le> length (interpret_excaps caps')
n + length (x # xs') \<le> 3 \<and> distinct slots

goal (1 subgoal):
 1. ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x # xs'). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x # xs') slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl a)) (precond n mi slots) [catchbrk_C] (constOnFailure (msgExtraCaps_update (\<lambda>_. word_of_nat n) mi) (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE)) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl a)) (precond n mi slots) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 ?Q'21 [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 ?Q'24 [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ?Q'24
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 ?Q'24 [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)
FI)
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ?Q'24
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 ?R'31 [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (?R'31 \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 ?R'31 [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== \<acute>i + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI (?R'31 \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'49 rv') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard ArrayBounds \<lbrace>rv' < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat rv']);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,rv');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat rv' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat rv')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== rv' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> ?G'49 (i_' s)} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?C'553 rv') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (\<acute>slot :== excaprefs_C caps'.[unat rv'];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,rv');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat rv' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat rv')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== rv' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> ?C'553 (i_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'557 rv') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])));;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,rv');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat rv' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat rv')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat rv'],\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat rv'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== rv' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?Q'1256 rv') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,rv');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat rv' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat rv')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat rv'],\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat rv'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== rv' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) (?Q'1256 rv')
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>rv' rv'a. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'1260 rv' rv'a) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(rv'a);;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(rv'a);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(rv'a);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,rv');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat rv' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat rv')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat rv'],rv'a);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat rv'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== rv' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> ?G'1260 rv' (cap_' s)}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'1260 n' cap') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> ?G'1260 rv' (cap_' s)}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'1946 n' cap') [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap');;
(\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> ?G'1946 rv' (cap_' s) \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?G'2117 n' cap' ret__unsigned) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?Q'2266 n' cap' ret__unsigned) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI (?Q'2266 n' cap' ret__unsigned)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?Q'2266 n' cap' ret__unsigned) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
FI)
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI (?Q'2266 n' cap' ret__unsigned)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Q21 (?P'2273 n' cap' ret__unsigned) [catchbrk_C] (if isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep then doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE else case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF ?val2273 n' cap' ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
FI)
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI (?P'2273 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>ret__int = ?val2273 n' cap' ret__unsigned\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ?Q21 s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ?Q21 s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) = (s' \<in> \<lbrace>?val2273 n' cap' ret__unsigned \<noteq> 0\<rbrace>)
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?Rt2710 n' cap' ret__unsigned) [catchbrk_C] (doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>?val2273 n' cap' ret__unsigned \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt2710 n' cap' ret__unsigned) \<and> (s \<notin> \<lbrace>?val2273 n' cap' ret__unsigned \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = ?val2273 n' cap' ret__unsigned\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' acap s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) = (?val2273 n' cap' (cap_get_tag cap') \<noteq> 0)
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?Rt2710 n' cap' ret__unsigned) [catchbrk_C] (doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>?val2273 n' cap' ret__unsigned \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt2710 n' cap' ret__unsigned) \<and> (s \<notin> \<lbrace>?val2273 n' cap' ret__unsigned \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = ?val2273 n' cap' ret__unsigned\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?Rt2710 n' cap' ret__unsigned) [catchbrk_C] (doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt2710 n' cap' ret__unsigned) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?Rt2710 n' cap' ret__unsigned) [catchbrk_C] (doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(cap');;
(CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,n');;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rt2710 n' cap' ret__unsigned) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?G'2738 n' cap' ret__unsigneda ret__unsigned) [catchbrk_C] (doE y <- liftE (setExtraBadge rcv_buffer (capEPBadge (fst x)) n);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
odE) (CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) ret__unsigned,n');;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'2738 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pt2712 (?G'2738 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) [catchbrk_C] (do y <- setExtraBadge rcv_buffer (capEPBadge (fst x)) n;
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))
od) (CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n');;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'2738 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> ?Pt2712 s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' ret__unsigneda ret__unsigned rv) (?Q'2840 n' cap' ret__unsigneda ret__unsigned rv xfdc) [catchbrk_C] (liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'2840 n' cap' ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?Q'2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc) [catchbrk_C] (liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi))) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'2840 n' cap' ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?Q'2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
(Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'2840 n' cap' ret__unsigneda ret__unsigned rv (xfdc s)}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?G'3217 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (Guard ShiftError \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n')));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> ?G'3217 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v}}}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?C'3221 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat n'));;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> ?C'3221 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?Q'3763 n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))
 2. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) \<acute>i :== n' + 1 (?Q'3763 n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info)
 3. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; ?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv) (?Q'3763 n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' slots (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi)) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) \<acute>i :== n' + 1 (?Q'3763 n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info)
 3. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; ?Q2840 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>?Q2840 n' cap' ret__unsigneda ret__unsigned\<rbrace>
 5. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> drop (Suc n) (interpret_excaps caps') = excaps_map xs' \<and> Suc n \<le> length (interpret_excaps caps')
 2. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> Suc n + length xs' \<le> 3 \<and> distinct slots
 3. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) \<acute>i :== n' + 1 (precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots)
 4. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 5. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 6. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> Suc n + length xs' \<le> 3 \<and> distinct slots
 2. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) \<acute>i :== n' + 1 (precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots)
 3. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 5. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info) \<acute>i :== n' + 1 (precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots)
 2. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'3760 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap')) rv xfdc ret__unsigned info \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 4. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' sa) sa)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) sa \<in> {sa. sa \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> sa \<in> ?G'3760 n' cap' ret__unsigneda ret__unsigned rv (xfdc s) v va}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsignedb rv xfdc ret__unsigned info s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsignedb = capEPBadge_CL (cap_endpoint_cap_lift cap'); dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 3. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> s \<in> {s. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) s \<in> {s. s \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots}}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R2849\<rbrace> setExtraBadge rcv_buffer (capEPBadge (fst x)) n \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 2. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> s \<in> {s. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) s \<in> {s. s \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots}}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and ?R2849) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) (capEPBadge_CL (cap_endpoint_cap_lift cap')),n') {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = capsUnwrapped_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> \<lbrace>v = capsUnwrapped_CL (seL4_MessageInfo_lift \<acute>info)\<rbrace> \<longrightarrow> s \<in> {s. \<forall>va. seL4_MessageInfo_lift va = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)))\<lparr>capsUnwrapped_CL := v32_' (v32_'_update (\<lambda>_. v || SCAST(32 signed \<rightarrow> 32) (1 << unat n')) (seL4_MessageInfo_'_update (\<lambda>_. info_' s) s)) && mask 3\<rparr> \<longrightarrow> info_'_update (\<lambda>_. va) s \<in> {s. s \<in> \<lbrace>seL4_MessageInfo_lift va = seL4_MessageInfo_lift \<acute>info\<lparr>capsUnwrapped_CL := (v || 2 ^ unat n') && mask 3\<rparr>\<rbrace> \<longrightarrow> s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots}}} \<inter> \<lbrace>unat n' < 31 \<and> 0 \<le>s 1\<rbrace>}}}
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigneda ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; ret__unsigned = capEPBadge_CL (cap_endpoint_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2841 n' cap' (cap_get_tag cap') (capEPBadge_CL (cap_endpoint_cap_lift cap'))) CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,capEPBadge_CL (cap_endpoint_cap_lift cap'),n') {s. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> ?R'2841 n' cap' ret__unsigned v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' ret__unsigned) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' (cap_get_tag cap')) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?Rf2710 n' cap' (cap_get_tag cap')) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (lvar_nondet_init dc_ret_' dc_ret_'_update;;
(IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> ?Rf2710 n' cap' ret__unsigned)} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?Pf2714 (?G'3901 n' cap' (cap_get_tag cap')) [catchbrk_C] (case slots of [] \<Rightarrow> returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi | destSlot # slots' \<Rightarrow> doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) destSlot;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' slots' mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> ?G'3901 n' cap' ret__unsigned})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> ?Pf2714 s)) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?R3937 (?R''3934 n' cap' (cap_get_tag cap')) [catchbrk_C] (returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> ?R''3934 n' cap' ret__unsigned} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?R3937 (?R'3942 n' cap' (cap_get_tag cap')) [catchbrk_C] (returnOk $ msgExtraCaps_update (\<lambda>_. fromIntegral n) mi) (break_C;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> ?R'3942 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?R3937 (?R'3942 n' cap' (cap_get_tag cap')) [catchbrk_C] (liftE (return (msgExtraCaps_update (\<lambda>_. word_of_nat n) mi))) (break_C;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> ?R'3942 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?R3937 (?R'3942 n' cap' (cap_get_tag cap')) [catchbrk_C] (return (msgExtraCaps_update (\<lambda>_. word_of_nat n) mi)) (break_C;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> ?R'3942 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. a = msgExtraCaps_update (\<lambda>_. fst b) (message_info_to_H (snd b)) \<and> fst b \<le> 3) (\<lambda>s. (i_' s, info_' s)) ?R3937 (?P'3955 n' cap' (cap_get_tag cap')) [catchbrk_C] (return (msgExtraCaps_update (\<lambda>_. word_of_nat n) mi)) break_C
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3954 n' cap' (cap_get_tag cap')) break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> ?P'3955 n' cap' ret__unsigned \<inter> ?R'3954 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> ?R3937 s) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigned s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace>\<rbrakk> \<Longrightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst (i_' s', info_' s')) (message_info_to_H (snd (i_' s', info_' s'))) \<and> fst (i_' s', info_' s') \<le> 3
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3954 n' cap' (cap_get_tag cap')) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'3954 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3954 n' cap' (cap_get_tag cap')) break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'3954 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = []\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3954 n' cap' (cap_get_tag cap')) break_C {},UNIV
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'3954 n' cap' ret__unsigned \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (\<lambda>a. ?R3936 a x21 x22) (?R''3932 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (IF \<acute>destSlot = NULL THEN
  break_C
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R''3932 n' cap' ret__unsigned x xa}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3936 s x xa))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?R3972 x21 x22) (?R'3970 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure $ global.deriveCap (snd x) $ fst x;
whenE (isNullCap cap') $ throw undefined;
withoutFailure $ cteInsert cap' (snd x) x21;
withoutFailure $ transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi
odE) (SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R'3970 n' cap' ret__unsigned x xa \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?R3972 x21 x22) (?R'3970 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (doE cap' <- unifyFailure (global.deriveCap (snd x) (fst x));
a <- whenE (cap' = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap' (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))))
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?R'3970 n' cap' ret__unsigned x xa \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> ?R3972 x xa s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (?f'3984 n' cap' ret__unsigned x21 x22 \<currency> ?r'3984 n' cap' ret__unsigned x21 x22) (liftxf (?es3984 n' cap' ret__unsigned x21 x22) (?ef'3984 n' cap' ret__unsigned x21 x22) (?vf'3984 n' cap' ret__unsigned x21 x22) (?xf'3984 n' cap' ret__unsigned x21 x22)) (?P3994 x21 x22) (?P'3986 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (unifyFailure (global.deriveCap (snd x) (fst x))) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap'))
 2. \<And>n' cap' ret__unsigned x21 x22 rv' t t'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3984 n' cap' ret__unsigned x21 x22) rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 3. \<And>n' cap' ret__unsigned x21 x22 cap'a rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ?r'3984 n' cap' ret__unsigned x21 x22 cap'a (?vf'3984 n' cap' ret__unsigned x21 x22 rv'); ?ef'3984 n' cap' ret__unsigned x21 x22 rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' ret__unsigned x21 x22 cap'a) (?Q'3984 n' cap' ret__unsigned x21 x22 cap'a rv') [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ?ef'3984 n' cap' ret__unsigned x21 x22 rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'3984 n' cap' ret__unsigned x21 x22 err (?ef'3984 n' cap' ret__unsigned x21 x22 rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ?r'3984 n' cap' ret__unsigned x21 x22 cap'a (?vf'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s)) \<longrightarrow> s \<in> ?Q'3984 n' cap' ret__unsigned x21 x22 cap'a (?xf'3984 n' cap' ret__unsigned x21 x22 s))) \<and> (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'3984 n' cap' ret__unsigned x21 x22 err (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s)) (?es3984 n' cap' ret__unsigned x21 x22 s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (?xf'3984 n' cap' ret__unsigned x21 x22 s) (?es3984 n' cap' ret__unsigned x21 x22 s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?P'3986 n' cap' ret__unsigned x xa \<inter> ?R'3985 n' cap' ret__unsigned x xa \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (?P3994 x xa and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (?P3994 x xa and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ccorres (?f4001 n' cap' ret__unsigned x21 x22 \<currency> ?r'3984 n' cap' ret__unsigned x21 x22) (liftxf (?es3984 n' cap' ret__unsigned x21 x22) (?ef'3984 n' cap' ret__unsigned x21 x22) (?vf'3984 n' cap' ret__unsigned x21 x22) (?xf'3984 n' cap' ret__unsigned x21 x22)) (?P3994 x21 x22) (?P'3986 n' cap' (cap_get_tag cap') x21 x22) [catchbrk_C] (global.deriveCap (snd x) (fst x)) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap'))
 2. \<And>n' cap' ret__unsigned x21 x22 rv' t t'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3984 n' cap' ret__unsigned x21 x22) rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 3. \<And>n' cap' ret__unsigned x21 x22 cap'a rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ?r'3984 n' cap' ret__unsigned x21 x22 cap'a (?vf'3984 n' cap' ret__unsigned x21 x22 rv'); ?ef'3984 n' cap' ret__unsigned x21 x22 rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' ret__unsigned x21 x22 cap'a) (?Q'3984 n' cap' ret__unsigned x21 x22 cap'a rv') [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ?ef'3984 n' cap' ret__unsigned x21 x22 rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (?ef'3984 n' cap' ret__unsigned x21 x22 rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ?r'3984 n' cap' ret__unsigned x21 x22 cap'a (?vf'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s)) \<longrightarrow> s \<in> ?Q'3984 n' cap' ret__unsigned x21 x22 cap'a (?xf'3984 n' cap' ret__unsigned x21 x22 s))) \<and> (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (?ef'3984 n' cap' ret__unsigned x21 x22 (?xf'3984 n' cap' ret__unsigned x21 x22 s)) (?es3984 n' cap' ret__unsigned x21 x22 s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (?xf'3984 n' cap' ret__unsigned x21 x22 s) (?es3984 n' cap' ret__unsigned x21 x22 s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. slots = x # xa \<longrightarrow> s \<in> ?P'3986 n' cap' ret__unsigned x xa \<inter> ?R'3985 n' cap' ret__unsigned x xa \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (?P3994 x xa and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (?P3994 x xa and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' t t'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dc_ret_' rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 2. \<And>n' cap' ret__unsigned x21 x22 cap'a rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' ret__unsigned x21 x22 cap'a) (?Q'3984 n' cap' ret__unsigned x21 x22 cap'a rv') [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 3. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (?d'3984 n' cap' ret__unsigned x21 x22 rv')
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'3984 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 cap'a rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' ret__unsigned x21 x22 cap'a) (?Q'3984 n' cap' ret__unsigned x21 x22 cap'a rv') [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 2. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'3984 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 cap'a rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?Q'3984 n' cap' (cap_get_tag cap') x21 x22 cap'a rv') [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))))
 2. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'3984 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q3984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?G'4599 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- whenE (cap'a = capability.NullCap) (throwError ());
a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))
 2. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>?Q3984 n' cap' ret__unsigned x21 x22\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'4599 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> True \<longrightarrow> (cap'a = capability.NullCap) = (s' \<in> \<lbrace>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace>)
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?R4986 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?R'4982 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (throwError ()) break_C
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> ?R4986 n' cap' ret__unsigned x21 x22 a s) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?R'4982 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a = capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?R4986 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?R'4982 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (throwError ()) break_C
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> ?R4986 n' cap' ret__unsigned x21 x22 a s) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?R'4982 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a = capability.NullCap; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace>\<rbrakk> \<Longrightarrow> case Inl () of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst (i_' s', info_' s')) (message_info_to_H (snd (i_' s', info_' s'))) \<and> fst (i_' s', info_' s') \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst (i_' s', info_' s')) (message_info_to_H (snd (i_' s', info_' s'))) \<and> fst (i_' s', info_' s') \<le> 3
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a = capability.NullCap\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a = capability.NullCap\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (doE a <- liftE (cteInsert cap'a (snd x) x21);
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
odE) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?U4984 n' cap' (cap_get_tag cap') x21 x22 cap'a) (?U'4978 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) [catchbrk_C] (do a <- cteInsert cap'a (snd x) x21;
liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)
od) (CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> ?U4984 n' cap' ret__unsigned x21 x22 a s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> ?U'4978 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?Q'4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (liftE (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi)) (\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>y c. y = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?Q'4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi) (\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>y c. y = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi) (\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>y c. y = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi) (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc)
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; ?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 7. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 8. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 9. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 10. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>y c. y = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi) (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc)
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; ?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 7. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 8. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 9. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 10. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>y c. y = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv) (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) [catchbrk_C] (transferCapsToSlots ep rcv_buffer (Suc n) xs' x22 mi) (?s5575 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc)
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> ?s5575 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc = (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (?Q'5569 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc)
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; ?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>?Q4995 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned\<rbrace>
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 7. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 8. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 9. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 10. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> drop (Suc n) (interpret_excaps caps') = excaps_map xs' \<and> Suc n \<le> length (interpret_excaps caps')
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> Suc n + length xs' \<le> 3 \<and> distinct x22
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) = (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (precond (Suc n) mi x22)
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 7. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 8. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 9. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 10. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> Suc n + length xs' \<le> 3 \<and> distinct x22
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) = (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (precond (Suc n) mi x22)
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 7. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 8. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 9. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 10. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)) = (Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (precond (Suc n) mi x22)
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 6. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 7. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 8. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 9. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 10. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc) \<acute>i :== n' + 1 (precond (Suc n) mi x22)
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. destSlot_'_update (\<lambda>_. NULL) sa \<in> ?G'5046 n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv (xfdc s)}}
 5. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 6. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 8. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 9. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 10. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>i :== n' + 1 {s'. (s, s') \<in> rf_sr}
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned rv xfdc s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap; dc rv xfdc; (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) s\<rbrakk> \<Longrightarrow> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, i_'_update (\<lambda>_. n' + 1) sa) \<in> rf_sr}
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 4. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 5. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 7. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 8. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 9. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?R5003 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and ?R5003 n' cap' ret__unsigned x21 x22 a) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P5613 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a. valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. x22 \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set x22. cte_wp_at' (isNullCap \<circ> cteCap) sl s)\<rbrace>
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> ?P5613 n' cap' ret__unsigned x21 x22 a b)) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>?P5613 n' cap' (cap_get_tag cap') x21 x22 cap'a\<rbrace> cteInsert cap'a (snd x) x21 \<lbrace>\<lambda>a b. valid_pspace' b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) b \<and> cte_wp_at' (\<lambda>cte. (x22 = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) b \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) b) \<and> (\<forall>sl\<in>set x22. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl b)\<rbrace>
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 3. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> ?P5613 n' cap' ret__unsigned x21 x22 a b)) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 6. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 7. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 8. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 10. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv'); cap'a \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4996 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. destSlot_'_update (\<lambda>_. NULL) s \<in> {s. i_'_update (\<lambda>_. n' + 1) s \<in> precond (Suc n) mi x22}}}
 2. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> ?R'4996 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v)}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigneda x21 x22 cap'a rv' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigneda = cap_get_tag cap'; slots = x21 # x22; ccap_relation cap'a (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C rv')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?PT'4980 n' cap' (cap_get_tag cap') x21 x22 cap'a rv' ret__unsigned) break_C {},UNIV
 2. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'a. ccap_relation cap'a (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?PT'4980 n' cap' ret__unsigned x21 x22 cap'a (dc_ret_' s) v) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap'a \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 err rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' ret__unsigned x21 x22 err) (?Q''3984 n' cap' ret__unsigned x21 x22 err rv' err') [catchbrk_C] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n'],\<acute>destSlot);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' (cap_get_tag cap') x21 x22 ()) (?Q''3984 n' cap' (cap_get_tag cap') x21 x22 () rv' err') [catchbrk_C] (throwError ()) (break_C;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C rv');;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
(CALL cteInsert_'proc(deriveCap_ret_C.cap_C rv',excaprefs_C caps'.[unat n']);;
(\<acute>destSlot :== NULL;;
(\<acute>i :== n' + 1;;
(Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc();;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc();;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc();;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,\<acute>ret__unsigned);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || 2 ^ unat \<acute>i))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc();;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI)))))))))
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''3984 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>f c. case f of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst c) (message_info_to_H (snd c)) \<and> fst c \<le> 3) (\<lambda>s. (i_' s, info_' s)) (?QE3984 n' cap' (cap_get_tag cap') x21 x22 ()) (?P'5698 n' cap' (cap_get_tag cap') x21 x22 () rv' err') [catchbrk_C] (throwError ()) break_C
 2. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5697 n' cap' (cap_get_tag cap') x21 x22 () rv' err') break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>?QE3984 n' cap' ret__unsigned x21 x22\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> ?P'5698 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s) \<inter> ?R'5697 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' err' s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace>\<rbrakk> \<Longrightarrow> case Inl () of Inl x \<Rightarrow> msgExtraCaps_update (\<lambda>_. word_of_nat n) mi = msgExtraCaps_update (\<lambda>_. fst (i_' s', info_' s')) (message_info_to_H (snd (i_' s', info_' s'))) \<and> fst (i_' s', info_' s') \<le> 3 | Inr n \<Rightarrow> n = msgExtraCaps_update (\<lambda>_. fst (i_' s', info_' s')) (message_info_to_H (snd (i_' s', info_' s'))) \<and> fst (i_' s', info_' s') \<le> 3
 2. \<And>n' cap' ret__unsigned x21 x22 rv' err' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 3. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5697 n' cap' (cap_get_tag cap') x21 x22 () rv' err') break_C {},UNIV
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 5. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'5697 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 6. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 7. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 9. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 10. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' err' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> (i_' (s\<lparr>global_exn_var_' := Break\<rparr>), info_' (s\<lparr>global_exn_var_' := Break\<rparr>)) = (i_' s, info_' s)
 2. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5697 n' cap' (cap_get_tag cap') x21 x22 () rv' err') break_C {},UNIV
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'5697 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22 rv' err'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5697 n' cap' (cap_get_tag cap') x21 x22 () rv' err') break_C {},UNIV
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> ?R'5697 n' cap' ret__unsigned x21 x22 err (dc_ret_' s) (errstate s)))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?R3992 x21 x22\<rbrace> unifyFailure (global.deriveCap (snd x) (fst x)) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. a = capability.NullCap \<longrightarrow> True) and (\<lambda>s. a \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap a \<or> is_simple_cap' a) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' a and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>b. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 b \<longrightarrow> (valid_pspace' and valid_cap' a and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) a \<circ> cteCap) (snd x) s)) b \<and> valid_ipc_buffer_ptr' rcv_buffer b \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) b \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep a) \<longrightarrow> fst xa = a else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) a)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) a) (snd xa) b)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) a else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) a)) (snd xa) b)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of b) (snd x) a (cteCap c)) (snd x) b \<and> valid_mdb' b \<and> valid_objs' b \<and> (if xa = x21 then a = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) a = capability.NullCap) xa b)))) s)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and ?R3992 x xa) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rv s. (rv = capability.NullCap \<longrightarrow> True) \<and> (rv \<noteq> capability.NullCap \<longrightarrow> (cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap rv \<or> is_simple_cap' rv) (snd x) and valid_mdb' and valid_objs' and pspace_aligned' and valid_cap' rv and cte_wp_at' (\<lambda>c. True) (snd x) and (\<lambda>a. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 a \<longrightarrow> (valid_pspace' and valid_cap' rv and (\<lambda>s. snd x \<noteq> x21) and valid_objs' and (\<lambda>s. cte_wp_at' (is_derived' (ctes_of s) (snd x) rv \<circ> cteCap) (snd x) s)) a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>xa\<in>set xs'. valid_cap' (fst xa) a \<and> (cte_wp_at' (\<lambda>c. is_derived' (ctes_of a) (snd x) rv (cteCap c)) (snd x) a \<and> valid_mdb' a \<and> valid_objs' a \<and> (if snd xa = x21 then (x22 = [] \<longrightarrow> is_the_ep rv) \<longrightarrow> fst xa = rv else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (maskedAsFull (cteCap c) rv)) \<longrightarrow> fst xa = maskedAsFull (cteCap c) rv) (snd xa) a)) \<and> cte_wp_at' (\<lambda>c. is_derived' (ctes_of a) (snd x) rv (cteCap c)) (snd x) a \<and> valid_mdb' a \<and> valid_objs' a \<and> (if snd xa = x21 then fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) rv else cte_wp_at' (\<lambda>c. fst xa \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst xa) (maskedAsFull (cteCap c) rv)) (snd xa) a)) \<and> (\<forall>xa\<in>set x22. cte_wp_at' (\<lambda>c. is_derived' (ctes_of a) (snd x) rv (cteCap c)) (snd x) a \<and> valid_mdb' a \<and> valid_objs' a \<and> (if xa = x21 then rv = capability.NullCap else cte_wp_at' (\<lambda>c. maskedAsFull (cteCap c) rv = capability.NullCap) xa a)))) s)\<rbrace>, -
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rv s. rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap rv \<or> is_simple_cap' rv) (snd x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. True) (snd x) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 s \<longrightarrow> valid_pspace' s \<and> snd x \<noteq> x21 \<and> cte_wp_at' (\<lambda>a. is_derived' (ctes_of s) (snd x) rv (cteCap a)) (snd x) s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (if snd x = x21 then (x22 = [] \<longrightarrow> is_the_ep rv) \<longrightarrow> fst x = rv else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (cteCap c)) \<longrightarrow> fst x = maskedAsFull (cteCap c) rv) (snd x) s) \<and> (if snd x = x21 then fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap c) rv)) (snd x) s)) \<and> (\<forall>x\<in>set x22. if x = x21 then False else cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s))\<rbrace>, -
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 2. \<And>cap' ret__unsigned x21 x22 rv s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; valid_cap' rv s \<and> (rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rv \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rv \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrakk> \<Longrightarrow> rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap rv \<or> is_simple_cap' rv) (snd x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. True) (snd x) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 s \<longrightarrow> valid_pspace' s \<and> snd x \<noteq> x21 \<and> cte_wp_at' (\<lambda>a. is_derived' (ctes_of s) (snd x) rv (cteCap a)) (snd x) s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (if snd x = x21 then (x22 = [] \<longrightarrow> is_the_ep rv) \<longrightarrow> fst x = rv else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (cteCap c)) \<longrightarrow> fst x = maskedAsFull (cteCap c) rv) (snd x) s) \<and> (if snd x = x21 then fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap c) rv)) (snd x) s)) \<and> (\<forall>x\<in>set x22. if x = x21 then False else cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s))
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>cap' ret__unsigned x21 x22 rv s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22; valid_cap' rv s \<and> (rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rv \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rv \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrakk> \<Longrightarrow> rv \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>scte. capMasterCap (cteCap scte) = capMasterCap rv \<or> is_simple_cap' rv) (snd x) s \<and> valid_mdb' s \<and> valid_objs' s \<and> pspace_aligned' s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>c. True) (snd x) s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) x21 s \<longrightarrow> valid_pspace' s \<and> snd x \<noteq> x21 \<and> cte_wp_at' (\<lambda>a. is_derived' (ctes_of s) (snd x) rv (cteCap a)) (snd x) s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (if snd x = x21 then (x22 = [] \<longrightarrow> is_the_ep rv) \<longrightarrow> fst x = rv else cte_wp_at' (\<lambda>c. (x22 = [] \<longrightarrow> is_the_ep (cteCap c)) \<longrightarrow> fst x = maskedAsFull (cteCap c) rv) (snd x) s) \<and> (if snd x = x21 then fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv else cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap c) rv)) (snd x) s)) \<and> (\<forall>x\<in>set x22. if x = x21 then False else cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) x s))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea)\<rbrakk> \<Longrightarrow> snd x \<noteq> x21 \<and> (\<forall>x\<in>set xs'. (if snd x = x21 then True else \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = maskedAsFull (cteCap cte) rv)) \<and> (if snd x = x21 then fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv else \<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap cte) rv))))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea)\<rbrakk> \<Longrightarrow> snd x \<noteq> x21 \<and> (\<forall>x\<in>set xs'. (snd x = x21 \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv) \<and> (snd x \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap cte) rv)))))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea)\<rbrakk> \<Longrightarrow> snd x \<noteq> x21
 2. \<And>cap' x21 rv s acap cte ctea. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea)\<rbrakk> \<Longrightarrow> \<forall>x\<in>set xs'. (snd x = x21 \<longrightarrow> fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) rv) \<and> (snd x \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (maskedAsFull (cteCap cte) rv))))
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> (b = x21 \<longrightarrow> a \<noteq> capability.NullCap \<longrightarrow> stable_masked a rv) \<and> (b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv))))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> b = x21 \<longrightarrow> a \<noteq> capability.NullCap \<longrightarrow> stable_masked a rv
 2. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv)))
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' (fst (a, b)) s \<and> (\<exists>cte. ctes_of s (snd (a, b)) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst (a, b) = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd (a, b)) = Some cte \<and> (fst (a, b) \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst (a, b)) (cteCap cte)))\<rbrakk> \<Longrightarrow> b = x21 \<longrightarrow> a \<noteq> capability.NullCap \<longrightarrow> stable_masked a rv
 2. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv)))
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, x21) \<in> set xs'; valid_cap' a s; \<not> is_the_ep capability.NullCap; ctes_of s x21 = Some cte; a \<noteq> capability.NullCap; stable_masked a capability.NullCap\<rbrakk> \<Longrightarrow> stable_masked a rv
 2. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv)))
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'\<rbrakk> \<Longrightarrow> b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv)))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' (fst (a, b)) s \<and> (\<exists>cte. ctes_of s (snd (a, b)) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst (a, b) = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd (a, b)) = Some cte \<and> (fst (a, b) \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst (a, b)) (cteCap cte)))\<rbrakk> \<Longrightarrow> b \<noteq> x21 \<longrightarrow> (\<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = maskedAsFull (cteCap cte) rv)) \<and> (\<exists>cte. ctes_of s b = Some cte \<and> (a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cte) rv)))
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (cteCap cteb, b) \<in> set xs'; valid_cap' (cteCap cteb) s; ctes_of s b = Some cteb; cteCap cteb \<noteq> capability.NullCap \<longrightarrow> stable_masked (cteCap cteb) (cteCap cteb); b \<noteq> x21; is_the_ep (cteCap cteb)\<rbrakk> \<Longrightarrow> cteCap cteb = maskedAsFull (cteCap cteb) rv
 2. \<And>cap' x21 rv s acap cte ctea a b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; \<not> is_the_ep rv; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' a s; is_the_ep (cteCap cteb) \<longrightarrow> a = cteCap cteb; ctes_of s b = Some cteb; a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (cteCap cteb); b \<noteq> x21\<rbrakk> \<Longrightarrow> a \<noteq> capability.NullCap \<longrightarrow> stable_masked a (maskedAsFull (cteCap cteb) rv)
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; isEndpointCap rv \<longrightarrow> ep = None \<or> capEPPtr rv \<noteq> the ep; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' a s; isEndpointCap (cteCap cteb) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (cteCap cteb) = the ep \<longrightarrow> a = cteCap cteb; ctes_of s b = Some cteb; b \<noteq> x21; a \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) rv \<noteq> a; cteCap cteb \<noteq> a \<longrightarrow> cteCap cteb = maskedAsFull a a\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) rv = maskedAsFull a a
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (11 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; isEndpointCap rv \<longrightarrow> ep = None \<or> capEPPtr rv \<noteq> the ep; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (cteCap cteb, b) \<in> set xs'; valid_cap' (cteCap cteb) s; ctes_of s b = Some cteb; b \<noteq> x21; cteCap cteb \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) rv \<noteq> cteCap cteb\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) rv = maskedAsFull (cteCap cteb) (cteCap cteb)
 2. \<And>cap' x21 rv s acap cte ctea a b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; isEndpointCap rv \<longrightarrow> ep = None \<or> capEPPtr rv \<noteq> the ep; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' a s; isEndpointCap (cteCap cteb) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (cteCap cteb) = the ep \<longrightarrow> a = cteCap cteb; ctes_of s b = Some cteb; b \<noteq> x21; a \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) rv \<noteq> a; cteCap cteb \<noteq> a \<longrightarrow> cteCap cteb = maskedAsFull a a; a \<noteq> cteCap cteb\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) rv = maskedAsFull a a
 3. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 4. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 5. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 6. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 8. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 9. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 10. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>cap' x21 rv s acap cte ctea a b cteb. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; slots = [x21]; valid_cap' rv s; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; valid_pspace' s; valid_ipc_buffer_ptr' rcv_buffer s; isEndpointCap rv \<longrightarrow> ep = None \<or> capEPPtr rv \<noteq> the ep; ctes_of s x21 = Some cte; cteCap cte = capability.NullCap; rv \<noteq> capability.NullCap; ctes_of s (snd x) = Some ctea; is_derived' (ctes_of s) (snd x) rv (cteCap ctea); (a, b) \<in> set xs'; valid_cap' a s; isEndpointCap (cteCap cteb) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (cteCap cteb) = the ep \<longrightarrow> a = cteCap cteb; ctes_of s b = Some cteb; b \<noteq> x21; a \<noteq> capability.NullCap; maskedAsFull (cteCap cteb) rv \<noteq> a; cteCap cteb \<noteq> a \<longrightarrow> cteCap cteb = maskedAsFull a a; a \<noteq> cteCap cteb\<rbrakk> \<Longrightarrow> maskedAsFull (cteCap cteb) rv = maskedAsFull a a
 2. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 3. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 5. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 7. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 8. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 9. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 10. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<lbrace>?P'5728 x21 x22\<rbrace> global.deriveCap (snd x) (fst x) \<lbrace>\<lambda>rcap s. valid_cap' rcap s \<and> (rcap \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (is_derived' (ctes_of s) (snd x) rcap \<circ> cteCap) (snd x) s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> length slots = 1 \<and> \<not> is_the_ep rcap \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)\<rbrace>, -
 2. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>x xa. slots = x # xa \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> ?P'5728 x xa a)) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' ret__unsigned x21 x22. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; x21 \<notin> set x22 \<and> distinct x22; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; slots = x21 # x22\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F3984 n' cap' ret__unsigned x21 x22\<^esub> (?R'3985 n' cap' (cap_get_tag cap') x21 x22) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C caps'.[unat n'],cap') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> \<lbrace>True\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>) \<and> (sa \<notin> \<lbrace>v = SCAST(32 signed \<rightarrow> 32) cap_null_cap\<rbrace> \<longrightarrow> sa \<in> {sa. srcSlot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) (newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa) \<in> UNIV \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace> \<inter> \<lbrace>\<acute>destSlot = cte_Ptr x21\<rbrace> \<inter> \<lbrace>\<acute>srcSlot = cte_Ptr (snd x)\<rbrace> \<inter> \<lbrace>ccap_relation cap' \<acute>newCap\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> precond (Suc n) mi x22})}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. dc (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s) \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> ?R'3985 n' cap' ret__unsigned xa xb \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>n' cap' ret__unsigned. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI ({s. (s \<in> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v v'. v = capEPBadge_CL (cap_endpoint_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. i_'_update (\<lambda>_. n') (badge_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (bufferPtr_'_update (\<lambda>_. PTR(32 word) rcv_buffer) s)) \<in> UNIV \<inter> \<lbrace>\<acute>bufferPtr = PTR(32 word) rcv_buffer\<rbrace> \<inter> \<lbrace>\<acute>badge = capEPBadge (fst x)\<rbrace> \<inter> \<lbrace>\<acute>i = word_of_nat n\<rbrace>} \<inter> {s. \<forall>t. (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr> \<in> (if unat n' < 31 \<and> 0 \<le>s 1 then UNIV else {})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap}) \<and> (s \<notin> \<lbrace>from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. \<forall>v. dc_ret_'_update (\<lambda>_. v) s \<in> {s. slots = [] \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat n \<and> mi = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>destSlot = NULL\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. slots = xa # xb \<longrightarrow> s \<in> {s. cap_'_update (\<lambda>_. cap') (slot_'_update (\<lambda>_. excaprefs_C caps'.[unat n']) s) \<in> UNIV \<inter> \<lbrace>ccap_relation (fst x) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd x)\<rbrace>} \<inter> {s. \<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s)) \<and> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>ta rv. dc rv (xfdc (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<in> precond (Suc n) mi xb)))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> dc (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s))} \<inter> - \<lbrace>\<acute>destSlot = NULL\<rbrace>}}}})} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>n' cap' acap. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' (cap_get_tag cap')) Cond (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)) SKIP ({s. (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> n' = word_of_nat n \<and> (\<forall>t v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> unat n' < 31 \<and> 0 \<le>s 1 \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (slots = [] \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = NULL) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> ccap_relation (fst x) cap' \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s)) \<and> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>ta. i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<in> precond (Suc n) mi xb))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s))) \<and> destSlot_' s \<noteq> NULL))} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>n' cap' acap. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' (cap_get_tag cap')) Cond (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)) SKIP (\<lbrace>\<acute>ret__int = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)\<rbrace> \<inter> precond n mi slots)
 2. \<And>n' cap' acap. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>ret__int = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)\<rbrace> \<inter> precond n mi slots \<subseteq> {s. (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> n' = word_of_nat n \<and> (\<forall>t v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> unat n' < 31 \<and> 0 \<le>s 1 \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (slots = [] \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = NULL) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> ccap_relation (fst x) cap' \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s)) \<and> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>ta. i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<in> precond (Suc n) mi xb))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s))) \<and> destSlot_' s \<noteq> NULL))} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'2117 n' cap' ret__unsigned \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> ?G'2117 rv' (cap_' s) v}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>n' cap' acap. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>ret__int = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)\<rbrace> \<inter> precond n mi slots \<subseteq> {s. (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> n' = word_of_nat n \<and> (\<forall>t v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> unat n' < 31 \<and> 0 \<le>s 1 \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (slots = [] \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = NULL) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> ccap_relation (fst x) cap' \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s)) \<and> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>ta. i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<in> precond (Suc n) mi xb))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s))) \<and> destSlot_' s \<noteq> NULL))} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>n' cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; xa \<in> \<lbrace>\<acute>ret__int = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)\<rbrace> \<inter> precond n mi slots\<rbrakk> \<Longrightarrow> xa \<in> {s. (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> n' = word_of_nat n \<and> (\<forall>t v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' s)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s)) || 2 ^ unat n') && mask 3\<rparr> \<longrightarrow> i_'_update (\<lambda>_. n' + 1) (info_'_update (\<lambda>_. v) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_' := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' s))\<rparr>)) \<in> precond (Suc n) (msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped mi || 2 ^ n) mi) slots) \<and> unat n' < 31 \<and> 0 \<le>s 1 \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap) \<and> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (slots = [] \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = NULL) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> ccap_relation (fst x) cap' \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s)) \<and> (cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> destSlot_' s = cte_Ptr xa \<and> excaprefs_C caps'.[unat n'] = cte_Ptr (snd x) \<and> (\<forall>ta. i_'_update (\<lambda>_. n' + 1) (destSlot_'_update (\<lambda>_. NULL) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<in> precond (Suc n) mi xb))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s))) \<and> destSlot_' s \<noteq> NULL))} \<inter> \<lbrace>\<acute>ret__int = from_bool (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)\<rbrace>
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || 2 ^ n) && mask 3\<rparr> \<longrightarrow> msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_to_H (info_' xa)) || 2 ^ n) (message_info_to_H (info_' xa)) = message_info_to_H v) \<and> 0 \<le>s 1 \<and> isEndpointCap acap) \<and> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || 2 ^ n) && mask 3\<rparr> \<longrightarrow> msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_to_H (info_' xa)) || 2 ^ n) (message_info_to_H (info_' xa)) = message_info_to_H v) \<and> 0 \<le>s 1 \<and> isEndpointCap acap
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr (Some (capEPPtr (fst x)))); ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; ep = Some (capEPPtr (fst x)); capEPPtr (fst x) \<noteq> 0\<rbrakk> \<Longrightarrow> capEPBadge_CL (cap_endpoint_cap_lift cap') = capEPBadge (fst x) \<and> (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || 2 ^ n) && mask 3\<rparr> \<longrightarrow> msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_to_H (info_' xa)) || 2 ^ n) (message_info_to_H (info_' xa)) = message_info_to_H v) \<and> 0 \<le>s 1
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa z. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr (Some (capEPPtr_CL (cap_endpoint_cap_lift cap')))); i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; ep = Some (capEPPtr_CL (cap_endpoint_cap_lift cap')); c_valid_cap cap'; cap_to_H z = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))); cap_lift cap' = Some z; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))\<rbrakk> \<Longrightarrow> (\<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || 2 ^ n) && mask 3\<rparr> \<longrightarrow> msgCapsUnwrapped_update (\<lambda>_. msgCapsUnwrapped (message_info_to_H (info_' xa)) || 2 ^ n) (message_info_to_H (info_' xa)) = message_info_to_H v) \<and> 0 \<le>s 1
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa z. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr (Some (capEPPtr_CL (cap_endpoint_cap_lift cap')))); i_' xa = word_of_nat n; mi = Types_H.message_info.MI (length_CL (seL4_MessageInfo_lift (info_' xa))) (extraCaps_CL (seL4_MessageInfo_lift (info_' xa))) (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa))) (label_CL (seL4_MessageInfo_lift (info_' xa))); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; ep = Some (capEPPtr_CL (cap_endpoint_cap_lift cap')); c_valid_cap cap'; cap_to_H z = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))); cap_lift cap' = Some z; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))\<rbrakk> \<Longrightarrow> ((\<exists>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || 2 ^ n && mask 3\<rparr>) \<longrightarrow> capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || 2 ^ n = capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || 2 ^ n && mask 3) \<and> 0 \<le>s 1
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa z. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr (Some (capEPPtr_CL (cap_endpoint_cap_lift cap')))); i_' xa = word_of_nat n; mi = Types_H.message_info.MI (length_CL (seL4_MessageInfo_lift (info_' xa))) (extraCaps_CL (seL4_MessageInfo_lift (info_' xa))) (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa))) (label_CL (seL4_MessageInfo_lift (info_' xa))); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; ep = Some (capEPPtr_CL (cap_endpoint_cap_lift cap')); c_valid_cap cap'; cap_to_H z = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))); cap_lift cap' = Some z; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))\<rbrakk> \<Longrightarrow> ((\<exists>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || (1 << n) && mask 3\<rparr>) \<longrightarrow> capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || (1 << n) = capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || (1 << n) && mask 3) \<and> 0 \<le>s 1
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa z. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr (Some (capEPPtr_CL (cap_endpoint_cap_lift cap')))); i_' xa = word_of_nat n; mi = Types_H.message_info.MI (length_CL (seL4_MessageInfo_lift (info_' xa))) (extraCaps_CL (seL4_MessageInfo_lift (info_' xa))) (capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa))) (label_CL (seL4_MessageInfo_lift (info_' xa))); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; ep = Some (capEPPtr_CL (cap_endpoint_cap_lift cap')); c_valid_cap cap'; cap_to_H z = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))); cap_lift cap' = Some z; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))\<rbrakk> \<Longrightarrow> ((\<exists>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (info_' xa)\<lparr>capsUnwrapped_CL := capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || (1 << n)\<rparr>) \<longrightarrow> capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) || (1 << n) = capsUnwrapped_CL (seL4_MessageInfo_lift (info_' xa)) && mask 3 || (1 << n) && mask 3) \<and> 0 \<le>s 1
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> ((isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)) \<and> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> (isEndpointCap (fst x) \<longrightarrow> ep = None \<or> capEPPtr (fst x) \<noteq> the ep) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>cap'. ccap_relation cap' (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> cap_get_tag (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> excaprefs_C caps'.[n] = cte_Ptr (snd x) \<and> NULL = (if xb = [] then NULL else cte_Ptr (hd xb)) \<and> length xb \<le> Suc 0 \<and> xb \<noteq> [0]) \<and> xa \<noteq> 0)
 2. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; ret__int_' xa = from_bool (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep); (slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; isEndpointCap acap; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; isEndpointCap acap; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; isEndpointCap acap; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))); ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep\<rbrakk> \<Longrightarrow> (\<exists>y. ep = Some y) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = the ep
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; isEndpointCap acap; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; capEPPtr acap \<noteq> 0; ret__int_' xa = 1; isEndpointCap acap; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); \<not> ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' xa. \<lbrakk>i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); \<not> ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' xa. \<lbrakk>i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); ccap_relation (fst x) cap'; capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap'))) = fst x\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); \<not> ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' xa. \<lbrakk>i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); ccap_relation (fst x) cap'; fst x = capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); \<not> ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa. \<lbrakk>(slots = [] \<longrightarrow> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<not> isEndpointCap (fst x); \<not> ccap_relation (fst x) cap'\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa. \<lbrakk>i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = NULL; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; ccap_relation (capability.EndpointCap (capEPPtr_CL (cap_endpoint_cap_lift cap')) (capEPBadge_CL (cap_endpoint_cap_lift cap')) (to_bool (capCanSend_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanReceive_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrant_CL (cap_endpoint_cap_lift cap'))) (to_bool (capCanGrantReply_CL (cap_endpoint_cap_lift cap')))) cap'; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> 0; ret__int_' xa = 1; ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep; \<forall>v0 v1 v2 v3 v4 v5. fst x \<noteq> capability.EndpointCap v0 v1 v2 v3 v4 v5; \<not> ccap_relation (fst x) cap'; slots = []; ep = None \<or> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> the ep\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) \<noteq> option_to_ptr ep; ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap'; v0 \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr acap \<noteq> 0; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; fst x = capability.EndpointCap v0 v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = ((\<exists>y. ep = Some y) \<and> v0 = the ep)
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (9 subgoals):
 1. \<And>cap' acap xa v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap'; v0 \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr acap \<noteq> 0; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; fst x = capability.EndpointCap v0 v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> ccap_relation (?bcap6115 cap' acap xa v0 v1 v2 v3 v4 v5) cap'
 2. \<And>cap' acap xa v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap'; v0 \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr acap \<noteq> 0; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; fst x = capability.EndpointCap v0 v1 v2 v3 v4 v5; acap = ?bcap6115 cap' acap xa v0 v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = ((\<exists>y. ep = Some y) \<and> v0 = the ep)
 3. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 4. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 6. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 7. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 8. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 9. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' acap xa v0 v1 v2 v3 v4 v5. \<lbrakk>ccap_relation (capability.EndpointCap v0 v1 v2 v3 v4 v5) cap'; v0 \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr acap \<noteq> 0; (\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; fst x = capability.EndpointCap v0 v1 v2 v3 v4 v5; acap = capability.EndpointCap v0 v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. acap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = ((\<exists>y. ep = Some y) \<and> v0 = the ep)
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa v1 v2 v3 v4 v5 y. \<lbrakk>ccap_relation (capability.EndpointCap y v1 v2 v3 v4 v5) cap'; y \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> y; ret__int_' xa = 0; fst x = capability.EndpointCap y v1 v2 v3 v4 v5; ep = Some y\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (8 subgoals):
 1. \<And>cap' xa v1 v2 v3 v4 v5 y z. \<lbrakk>y \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> y; ret__int_' xa = 0; fst x = capability.EndpointCap y v1 v2 v3 v4 v5; ep = Some y; c_valid_cap cap'; cap_lift cap' = Some z; cap_to_H z = capability.EndpointCap y v1 v2 v3 v4 v5\<rbrakk> \<Longrightarrow> False
 2. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 3. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 5. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 6. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 7. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 8. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (7 subgoals):
 1. \<And>cap' acap xa. \<lbrakk>(slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap'; isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0; i_' xa = word_of_nat n; mi = message_info_to_H (info_' xa); destSlot_' xa = (if slots = [] then NULL else cte_Ptr (hd slots)); length slots \<le> Suc 0; slots \<noteq> [0]; drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0; isEndpointCap acap \<longrightarrow> capEPPtr_CL (cap_endpoint_cap_lift cap') \<noteq> (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y); ret__int_' xa = 0; \<not> isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> (isEndpointCap acap \<and> capEPPtr_CL (cap_endpoint_cap_lift cap') = (case ep of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) = (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep)
 2. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 4. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 5. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 6. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 7. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap' ret__unsigned s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; \<exists>acap. ccap_relation acap cap' \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0); ret__unsigned = cap_get_tag cap'; ((\<lambda>_. True) and (\<lambda>s. is_the_ep (fst x) \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> is_the_ep (fst x) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> relative_at (fst x) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (s \<in> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap') \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (s \<notin> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' s = from_bool (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap'))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) IF (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI {s'. (s, s') \<in> rf_sr}
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (6 subgoals):
 1. \<And>n' cap' s acap. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; is_the_ep (fst x) \<longrightarrow> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> Suc (Suc (msg_max_length + n)) < unat max_ipc_words \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x s); \<not> is_the_ep (fst x) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> valid_objs' s \<and> valid_mdb' s \<and> valid_cap' (fst x) s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> relative_at (fst x) (snd x) s \<and> valid_objs' s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> xb = [] \<and> cte_wp_at' (isNullCap \<circ> cteCap) xa s \<and> (\<forall>x\<in>set xb. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s)); ccap_relation acap cap'; isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift cap')) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0) = from_bool (ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep) \<and> n' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift cap'), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift cap')) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag cap' \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ret__int_' s = false \<and> n' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift cap')))) \<longrightarrow> ccap_relation (fst x) cap') \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s \<in> precond n mi slots)} \<inter> {s'. (s, s') \<in> rf_sr}) Cond (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) (\<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(cap');;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)) SKIP {s'. (s, s') \<in> rf_sr}
 2. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 3. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 4. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 5. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 6. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (5 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. s \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap_' s) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0\<rparr> \<in> {sa. (sa \<in> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> (\<forall>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)) \<longrightarrow> (if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0) = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots)) \<and> (sa \<notin> (if v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then UNIV else {}) \<longrightarrow> (ret__int_' sa = from_bool (v = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<and> ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep) \<and> rv' = word_of_nat n \<and> (slots \<noteq> [] \<or> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s)))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> sa \<in> precond n mi slots)}}} \<inter> \<lbrace>\<exists>acap. ccap_relation acap \<^bsup>s\<^esup>cap \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)\<rbrace>}
 2. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 3. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 4. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (5 subgoals):
 1. \<And>rv'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv') Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s. (cap_get_tag (cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s))))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (cap_' s)), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (cap_' s))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (cap_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cap_' s))))) \<longrightarrow> ccap_relation (fst x) (cap_' s)) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>ret__unsigned_' := cap_get_tag (cap_' s), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (cap_' s) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}
 2. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'557 rv' \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 3. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> ?G'557 (i_' s)} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 4. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 5. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv'] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))} \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. is_the_ep (fst x) \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> is_the_ep (fst x) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv'] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))} \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; is_the_ep (fst x) \<longrightarrow> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> Suc (Suc (msg_max_length + n)) < unat max_ipc_words \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x s); \<not> is_the_ep (fst x) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> valid_objs' s \<and> valid_mdb' s \<and> valid_cap' (fst x) s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) s \<and> valid_objs' s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> xb = [] \<and> cte_wp_at' (isNullCap \<circ> cteCap) xa s \<and> (\<forall>x\<in>set xb. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv'] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))} \<inter> {s'. (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv']} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) {s'. (s, s') \<in> rf_sr}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (4 subgoals):
 1. \<And>rv' s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; is_the_ep (fst x) \<longrightarrow> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> Suc (Suc (msg_max_length + n)) < unat max_ipc_words \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x s); \<not> is_the_ep (fst x) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> valid_objs' s \<and> valid_mdb' s \<and> valid_cap' (fst x) s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) s \<and> valid_objs' s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> xb = [] \<and> cte_wp_at' (isNullCap \<circ> cteCap) xa s \<and> (\<forall>x\<in>set xb. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s))\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv'] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> rv' = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> s\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat rv'] \<and> (s, cap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat rv']\<rightarrow>[''cap_C'']))) sa) \<in> rf_sr}
 2. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 3. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 4. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (3 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<in> {sa. slot_'_update (\<lambda>_. excaprefs_C caps'.[unat (i_' s)]) sa \<in> {sa. sa \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))), ret__int_' := if ep_Ptr (capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) = option_to_ptr ep then 1 else 0\<rparr> \<in> precond n mi slots) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> sa\<lparr>cap_' := h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])), ret__unsigned_' := cap_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))), ret__int_' := 0\<rparr> \<in> precond n mi slots) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals sa))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0))}} \<inter> \<lbrace>\<^bsup>s\<^esup>i < 3\<rbrace>} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 2. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (3 subgoals):
 1. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ?Q'21 Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI ({s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 2. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'21 \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI {s'. (s, s') \<in> rf_sr}
 3. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> ?Q'21 proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0))) {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {sa. sa\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' sa)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s'. (s, s') \<in> rf_sr}}) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s'. (s, s') \<in> rf_sr})}
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; ((\<lambda>_. True) and (\<lambda>s. is_the_ep (fst x) \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> is_the_ep (fst x) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0))) {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {sa. sa\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' sa)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s'. (s, s') \<in> rf_sr}}) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {s'. (s, s') \<in> rf_sr})}
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; is_the_ep (fst x) \<longrightarrow> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> Suc (Suc (msg_max_length + n)) < unat max_ipc_words \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>x\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) x s); \<not> is_the_ep (fst x) \<longrightarrow> (\<forall>xa xb. slots = xa # xb \<longrightarrow> valid_objs' s \<and> valid_mdb' s \<and> valid_cap' (fst x) s \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) s \<and> valid_objs' s) \<and> valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> xb = [] \<and> cte_wp_at' (isNullCap \<circ> cteCap) xa s \<and> (\<forall>x\<in>set xb. cte_wp_at' (isNullCap \<circ> cteCap) x s) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) s \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) s))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ((if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) \<inter> ((if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) \<inter> {s. (i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 \<longrightarrow> i_' s < 3 \<and> s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3 \<and> excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL) \<and> i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1}) \<inter> {s'. (s, s') \<in> rf_sr}) Guard ShiftError (if 0 \<le>s seL4_MsgExtraCapBits then UNIV else {}) (Guard ShiftError (if seL4_MsgExtraCapBits <s 0x20 then UNIV else {}) (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0))) {sa. (ret__int_' sa \<noteq> 0 \<longrightarrow> i_' sa < 3 \<and> (s, sa) \<in> rf_sr) \<and> (ret__int_' sa = 0 \<longrightarrow> (s, sa) \<in> rf_sr)}
 2. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> (isEndpointCap (fst x) \<and> (\<exists>y. ep = Some y) \<and> capEPPtr (fst x) = the ep) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>drop n (interpret_excaps caps') = excaps_map (x # xs'); n \<le> length (interpret_excaps caps'); n + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_pspace' s \<and> valid_ipc_buffer_ptr' rcv_buffer s \<and> valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) \<and> (\<forall>sl\<in>set slots. cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) sl s); s' \<in> precond n mi slots\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. is_the_ep (fst x) \<longrightarrow> (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>_. msg_max_length + 2 + n < unat max_ipc_words) and (\<lambda>a. valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) a \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) a) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a))) s) and (\<lambda>s. \<not> is_the_ep (fst x) \<longrightarrow> (slots = [] \<longrightarrow> True) \<and> (\<forall>xa xb. slots = xa # xb \<longrightarrow> (valid_objs' and valid_mdb' and (\<lambda>a. True \<and> True \<and> True \<and> valid_cap' (fst x) a \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cte_wp_at' (\<lambda>cte. badge_derived' (fst x) (cteCap cte) \<and> capASID (fst x) = capASID (cteCap cte) \<and> cap_asid_base' (fst x) = cap_asid_base' (cteCap cte) \<and> cap_vptr' (fst x) = cap_vptr' (cteCap cte)) (snd x) a \<and> valid_objs' a) \<and> valid_pspace' a \<and> valid_ipc_buffer_ptr' rcv_buffer a \<and> length slots = 1 \<and> \<not> is_the_ep (fst x) \<and> (\<forall>x\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) x a) \<and> (\<forall>x\<in>set xs'. valid_cap' (fst x) a \<and> cte_wp_at' (\<lambda>c. is_the_ep (cteCap c) \<longrightarrow> fst x = cteCap c) (snd x) a \<and> cte_wp_at' (\<lambda>c. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap c)) (snd x) a))) s))) s \<and> s' \<in> \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> \<inter> (\<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if i_' s < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0\<rparr> \<in> {s. (s \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> \<lbrace>\<acute>i < 3\<rbrace> \<inter> {s. s\<lparr>ret__int_' := if excaprefs_C caps'.[unat (i_' s)] \<noteq> NULL then 1 else 0\<rparr> \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (s \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> s \<in> {s. s \<Turnstile>\<^sub>c excaprefs_C caps'.[unat (i_' s)] \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))) \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> i_' s = word_of_nat n \<and> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0) \<and> i_' s = word_of_nat n \<and> mi = message_info_to_H (info_' s) \<and> destSlot_' s = (if slots = [] then NULL else cte_Ptr (hd slots)) \<and> length slots \<le> Suc 0 \<and> slots \<noteq> [0]) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(excaprefs_C caps'.[unat (i_' s)]\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> i_' s < 3} \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)}}) proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ (case x of (cp, x) \<Rightarrow> cte_Ptr x) # map (\<lambda>(cp, y). cte_Ptr y) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; ctes_of s (snd x) = Some cte; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)\<rbrakk> \<Longrightarrow> (\<not> is_the_ep (fst x) \<longrightarrow> (\<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)))) \<and> s' \<Turnstile>\<^sub>c (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))) \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ (case x of (cp, x) \<Rightarrow> cte_Ptr x) # map (\<lambda>(cp, y). cte_Ptr y) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; ctes_of s (snd x) = Some cte; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (\<not> is_the_ep (fst x) \<longrightarrow> (\<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)))) \<and> s' \<Turnstile>\<^sub>c (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))) \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ (case x of (cp, x) \<Rightarrow> cte_Ptr x) # map (\<lambda>(cp, y). cte_Ptr y) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; ctes_of s (snd x) = Some cte; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'\<rbrakk> \<Longrightarrow> (\<not> is_the_ep (fst x) \<longrightarrow> (\<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)))) \<and> s' \<Turnstile>\<^sub>c (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))) \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))))))) \<longrightarrow> ccap_relation (fst x) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C''])))) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (\<exists>acap. ccap_relation acap (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(case x of (cp, x) \<Rightarrow> cte_Ptr x\<rightarrow>[''cap_C'']))) \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) \<and> (case x of (cp, x) \<Rightarrow> cte_Ptr x) \<noteq> NULL proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'\<rbrakk> \<Longrightarrow> (\<not> is_the_ep (fst x) \<longrightarrow> (\<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)))) \<and> (cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y'))) \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))) \<longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))) \<longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (\<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> (\<not> is_the_ep (fst x) \<longrightarrow> (\<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)))) \<and> (cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> (\<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y'))) \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))) \<longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap \<longrightarrow> ((slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))) \<longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')) \<and> (isEndpointCap (fst x) \<longrightarrow> capEPPtr (fst x) \<noteq> 0)) \<and> (\<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0)) proof (prove)
goal (6 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); \<not> is_the_ep (fst x)\<rbrakk> \<Longrightarrow> \<forall>x xa. slots = x # xa \<longrightarrow> xa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte))
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 6. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (6 subgoals):
 1. \<And>s s' xs'a cte y' xa xaa. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); \<not> is_the_ep (fst x); slots = xa # xaa\<rbrakk> \<Longrightarrow> xaa = [] \<and> (\<forall>x\<in>set xs'. \<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte))
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 6. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (6 subgoals):
 1. \<And>s s' xs'a cte y' xa a b ctea. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = cte_Ptr xa; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); cteCap cte \<noteq> capability.NullCap \<longrightarrow> stable_masked (cteCap cte) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); \<not> is_the_ep (cteCap cte); slots = [xa]; (a, b) \<in> set xs'; ctes_of s xa = Some ctea; cteCap ctea = capability.NullCap\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s b = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> a = cteCap cte)
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 6. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (5 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (5 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> fst x = cteCap cte
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (5 subgoals):
 1. \<And>s s' xs'a cte y' t. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y')))); ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); fst x \<noteq> cteCap cte; slots = []\<rbrakk> \<Longrightarrow> is_the_ep (cteCap cte)
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (6 subgoals):
 1. \<And>s s' xs'a cte y' t. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); fst x \<noteq> cteCap cte; slots = []; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> is_the_ep (cteCap cte)
 2. \<And>s s' xs'a cte y' t. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); fst x \<noteq> cteCap cte; slots = []; is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> is_the_ep (cteCap cte)
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 6. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (5 subgoals):
 1. \<And>s s' xs'a cte y' t. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); fst x \<noteq> cteCap cte; slots = []; is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> is_the_ep (cteCap cte)
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 5. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (4 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; \<exists>t. ret__unsigned_' t = capEPPtr_CL (cap_endpoint_cap_lift (cte_C.cap_C y')); isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (3 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (4 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y')))); slots \<noteq> []\<rbrakk> \<Longrightarrow> ccap_relation (fst x) (cte_C.cap_C y')
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> slots \<noteq> []
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (3 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = [] \<longrightarrow> isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> slots \<noteq> []
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (3 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x) \<or> is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y')))); slots = []\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (4 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = []; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = []; is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> False
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (4 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> cteCap cte \<noteq> fst x \<longrightarrow> cteCap cte = maskedAsFull (fst x) (fst x))); cteCap cte = fst x; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (fst x) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = []; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = []; is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> False
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 4. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (3 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = NULL; no_0_obj' s; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; slots = []; is_the_ep (cap_to_H (the (cap_lift (cte_C.cap_C y'))))\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 3. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (2 subgoals):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y'); cap_get_tag (cte_C.cap_C y') \<noteq> SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap; isEndpointCap (fst x)\<rbrakk> \<Longrightarrow> capEPPtr (fst x) \<noteq> 0
 2. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> \<exists>acap. ccap_relation acap (cte_C.cap_C y') \<and> (isEndpointCap acap \<longrightarrow> capEPPtr acap \<noteq> 0) proof (prove)
goal (1 subgoal):
 1. \<And>s s' xs'a cte y'. \<lbrakk>length xs'a \<le> length (interpret_excaps caps'); length xs'a + length xs' \<le> 2; distinct slots; (s, s') \<in> rf_sr; valid_objs' s; i_' s' = word_of_nat (length xs'a); n = length xs'a; \<forall>n<Suc (length xs'a + length xs'). excaprefs_C caps'.[n] = (xs'a @ cte_Ptr (snd x) # map (\<lambda>p. cte_Ptr (snd p)) xs') ! n \<and> (length xs'a + length xs' < 2 \<longrightarrow> excaprefs_C caps'.[Suc (length xs'a + length xs')] = NULL); pspace_aligned' s; mi = message_info_to_H (info_' s'); pspace_distinct' s; destSlot_' s' = (if slots = [] then NULL else cte_Ptr (hd slots)); no_0_obj' s; length slots \<le> Suc 0; slots \<noteq> [0]; valid_mdb' s; valid_ipc_buffer_ptr' rcv_buffer s; valid_cap' (fst x) s; (slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte; \<forall>x\<in>set xs'. valid_cap' (fst x) s \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> ((slots = [] \<longrightarrow> is_the_ep (cteCap cte)) \<longrightarrow> fst x = cteCap cte)) \<and> (\<exists>cte. ctes_of s (snd x) = Some cte \<and> (fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte))); \<forall>sl\<in>set slots. \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap; fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte); valid_cap' (cteCap cte) s; ctes_of s (snd x) = Some cte; ccte_relation cte y'; cslift s' (cte_Ptr (snd x)) = Some y'; ccap_relation (cteCap cte) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> isEndpointCap (cteCap cte) \<longrightarrow> capEPPtr (cteCap cte) \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (\<lambda>r p. r = msgExtraCaps_update (\<lambda>_. fst p) (message_info_to_H (snd p)) \<and> fst p \<le> 3) (\<lambda>s. (i_' s, info_' s)) (valid_pspace' and valid_ipc_buffer_ptr' rcv_buffer and (\<lambda>s. \<forall>x\<in>set (x # xs'). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>cte. slots \<noteq> [] \<or> is_the_ep (cteCap cte) \<longrightarrow> fst x = cteCap cte) (snd x) s \<and> cte_wp_at' (\<lambda>cte. fst x \<noteq> capability.NullCap \<longrightarrow> stable_masked (fst x) (cteCap cte)) (snd x) s) and (\<lambda>s. \<forall>sl\<in>set slots. cte_wp_at' (isNullCap \<circ> cteCap) sl s)) (precond n mi slots) [catchbrk_C] (transferCapsToSlots ep rcv_buffer n (x # xs') slots mi) (Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>slot :== excaprefs_C caps'.[unat \<acute>i]);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_endpoint_cap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPPtr_'proc(\<acute>cap);;
\<acute>ret__int :== (if ep_Ptr \<acute>ret__unsigned = option_to_ptr ep then 1 else 0)
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_endpoint_cap_get_capEPBadge_'proc(\<acute>cap);;
CALL setExtraBadge_'proc(PTR(32 word) rcv_buffer,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,\<acute>i);;
\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_capsUnwrapped_'proc(\<acute>info);;
Guard ShiftError \<lbrace>unat \<acute>i < 31 \<and> 0 \<le>s 1\<rbrace> (\<acute>info :== CALL seL4_MessageInfo_set_capsUnwrapped_'proc(\<acute>info,\<acute>ret__unsigned || SCAST(32 signed \<rightarrow> 32) (1 << unat \<acute>i)))
ELSE
  lvar_nondet_init dc_ret_' dc_ret_'_update;;
IF \<acute>destSlot = NULL THEN
  break_C
FI;;
\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>slot,\<acute>cap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  break_C
FI;;
\<acute>ret__unsigned :== CALL cap_get_capType_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_null_cap THEN
  break_C
FI;;
CALL cteInsert_'proc(deriveCap_ret_C.cap_C \<acute>dc_ret,\<acute>slot,\<acute>destSlot);;
\<acute>destSlot :== NULL
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s seL4_MsgExtraCapBits\<rbrace> (Guard ShiftError \<lbrace>seL4_MsgExtraCapBits <s 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>i < 2 ^ unat seL4_MsgExtraCapBits - 1 then 1 else 0)));;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 3\<rbrace> (\<acute>ret__int :== (if excaprefs_C caps'.[unat \<acute>i] \<noteq> NULL then 1 else 0))
FI))

goal:
No subgoals!