theory Ipc_C

lemma doNormalTransfer_ccorres [corres]:
  "ccorres dc xfdc
    (valid_pspace' and cur_tcb' and tcb_at' sender
        and tcb_at' receiver
        and K (endpoint \<noteq> Some 0)
        and (case_option \<top> valid_ipc_buffer_ptr' sendBuffer)
        and (case_option \<top> valid_ipc_buffer_ptr' receiveBuffer))
    (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace>
          \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>
          \<inter> \<lbrace>\<acute>sendBuffer = Ptr (option_to_0 sendBuffer)\<rbrace>
          \<inter> \<lbrace>\<acute>receiveBuffer = Ptr (option_to_0 receiveBuffer)\<rbrace>
          \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace>
          \<inter> \<lbrace>\<acute>badge = badge\<rbrace>
          \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>)  []
    (doNormalTransfer sender sendBuffer endpoint badge canGrant
                      receiver receiveBuffer)
    (Call doNormalTransfer_'proc)" proof - have word_0_le_helper:
    "\<And>i :: sword32. \<lbrakk> i <s (1 << unat (scast seL4_MsgExtraCapBits :: word32)) - 1; 0 <=s i \<rbrakk>
           \<Longrightarrow> 0 <=s i + 1" apply (simp add: seL4_MsgExtraCapBits_def word_sle_msb_le
                                 word_sless_msb_less msb_nth) apply (clarsimp simp: word_eq_iff) apply (drule bang_is_le) apply (unat_arith; simp add: take_bit_nat_def) done show ?thesis apply (cinit lift: sender_' receiver_' sendBuffer_' receiveBuffer_'
                       canGrant_' badge_' endpoint_'
                 cong: call_ignore_cong) apply (clarsimp cong: call_ignore_cong) apply (ctac(c_lines 2, no_vcg) add: getMessageInfo_ccorres') apply (rule_tac xf'="\<lambda>s. current_extra_caps_' (globals s)"
                   and r'="\<lambda>c c'. interpret_excaps c' = excaps_map c"
              in ccorres_split_nothrow_novcg) apply (rule ccorres_if_lhs) apply (simp add: catch_def to_bool_def ccorres_cond_iffs) apply (rule_tac xf'="\<lambda>s. (status_' s, current_extra_caps_' (globals s))"
                        and ef'=fst and vf'=snd and es=errstate and R'=UNIV
                   in ccorres_split_nothrow_case_sum) apply (rule ccorres_call, rule lookupExtraCaps_ccorres, simp+) apply (rule ceqv_tuple2, ceqv, ceqv) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip') apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def excaps_map_def interpret_excaps_empty
                                    word_sless_def word_sle_def) apply wp apply simp apply (vcg exspec=lookupExtraCaps_modifies, simp) apply (simp add: to_bool_def ccorres_cond_iffs) apply (rule ccorres_return[where R=\<top> and R'=UNIV], vcg) apply (clarsimp simp: excaps_map_def interpret_excaps_empty) apply ceqv apply csymbr apply (ctac add: copyMRs_ccorres) apply (ctac add: transferCaps_ccorres) apply csymbr apply (ctac(c_lines 2, no_vcg) add: setMessageInfo_ccorres) apply ctac apply wp apply (clarsimp simp: Kernel_C.badgeRegister_def ARM_H.badgeRegister_def
                                ARM.badgeRegister_def Kernel_C.R0_def) apply wp apply (simp add: seL4_MessageInfo_lift_def message_info_to_H_def msgLengthBits_def) apply (vcg exspec=transferCaps_modifies) apply (wpsimp wp: hoare_case_option_wp) apply clarsimp apply (vcg exspec=copyMRs_modifies) apply (wpsimp wp: lookupExtraCaps_length) apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (clarsimp simp: seL4_MessageInfo_lift_def message_info_to_H_def mask_def
                             msgLengthBits_def word_bw_assocs) apply (wp getMessageInfo_le3 getMessageInfo_msgLength[unfolded K_def] hoare_weak_lift_imp
                  | simp)+ apply (simp add: Collect_const_mem) apply (auto simp: excaps_in_mem_def valid_ipc_buffer_ptr'_def
                       option_to_0_def option_to_ptr_def
                       seL4_MessageInfo_lift_def mi_from_H_def message_info_to_H_def
                split: option.split) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>sendBuffer = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>) [] (doNormalTransfer sender sendBuffer endpoint badge canGrant receiver receiveBuffer) (Call doNormalTransfer_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>sendBuffer = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>) [] (doNormalTransfer sender sendBuffer endpoint badge canGrant receiver receiveBuffer) (Call doNormalTransfer_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i <s (1 << unat (SCAST(32 signed \<rightarrow> 32) seL4_MsgExtraCapBits)) - 1; 0 \<le>s i\<rbrakk> \<Longrightarrow> 0 \<le>s i + 1 proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i < 3; \<not> i !! 31\<rbrakk> \<Longrightarrow> \<not> (i + 1) !! 31 proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i < 3; \<not> i !! 31; (i + 1) !! 31\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>i. \<lbrakk>i < 3; \<not> i !! 31; 2 ^ 31 \<le> i + 1\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>?i1 <s (1 << unat (SCAST(32 signed \<rightarrow> 32) seL4_MsgExtraCapBits)) - 1; 0 \<le>s ?i1\<rbrakk> \<Longrightarrow> 0 \<le>s ?i1 + 1

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>sendBuffer = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>) [] (doNormalTransfer sender sendBuffer endpoint badge canGrant receiver receiveBuffer) (Call doNormalTransfer_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>sendBuffer = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>) [] (doNormalTransfer sender sendBuffer endpoint badge canGrant receiver receiveBuffer) (Call doNormalTransfer_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) (?Q'2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) [SKIP] (do tag <- getMessageInfo sender;
caps <- if canGrant then lookupExtraCaps sender sendBuffer tag `~catchFailure~` const (return []) else return [];
msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength tag);
tag' <- transferCaps tag caps endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(sendera,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(IF canGranta \<noteq> 0 THEN
  \<acute>status :== CALL lookupExtraCaps_'proc(sendera,sendBuffera,\<acute>tag);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI
ELSE
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI;;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>tag);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(sendera,sendBuffera,receivera,receiveBuffera,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(\<acute>tag,endpointa,receivera,receiveBuffera);;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(receivera,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(receivera,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badgea))))))))))
 2. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s \<and> s' \<in> ?Q'2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera proof (prove)
goal (2 subgoals):
 1. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> ccorres dc xfdc (?Q2874 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q'2874 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) [SKIP] (do tag <- getMessageInfo sender;
caps <- if to_bool canGranta then lookupExtraCaps sender sendBuffer tag `~catchFailure~` const (return []) else return [];
msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength tag);
tag' <- transferCaps tag caps endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister);;
(\<acute>tag :== CALL messageInfoFromWord_'proc(\<acute>ret__unsigned_long);;
(Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),\<acute>tag);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(\<acute>tag);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(\<acute>tag,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))))))
 2. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s \<and> s' \<in> ?Q'2874 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera proof (prove)
goal (4 subgoals):
 1. \<And>canGranta rv xfdca. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2892 canGranta rv) (?Q'2892 canGranta rv xfdca) [SKIP] (do caps <- if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [];
msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv caps endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdca);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps);;
(\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdca);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdca,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))))
 2. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>?Q2892 canGranta\<rbrace>
 3. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2892 canGranta rv (tag_' s)
 4. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?P3098 canGranta rv) (?Q'2892 canGranta rv xfdc) [] (if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 2. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. ?P3098 canGranta a and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'2892 canGranta rv (tag_' s)
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3102 canGranta rv) (?S3100 canGranta rv xfdc) [] (lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return [])) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 3. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 7. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> ?Q3102 canGranta a s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 8. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> ?S3100 canGranta rv (tag_' s)) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 9. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3102 canGranta (message_info_to_H xfdc)) (?S3100 canGranta (message_info_to_H xfdc) xfdc) [] (lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) >>= case_sum (const (return [])) return) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI)
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 3. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 7. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> ?Q3102 canGranta a s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 8. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> ?S3100 canGranta rv (tag_' s)) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 9. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (14 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?f'3114 canGranta rv xfdc \<currency> ?r'3114 canGranta rv xfdc) (liftxf errstate fst snd (\<lambda>s. (status_' s, current_extra_caps_' (globals s)))) (?P3121 canGranta (message_info_to_H xfdc)) (?P'3115 canGranta (message_info_to_H xfdc) xfdc) [] (lookupExtraCaps sender sendBuffer (message_info_to_H xfdc)) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc))
 2. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) rv' t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (?d'3114 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdc rva rv'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; ?r'3114 canGranta rv xfdc rva (snd rv'); fst rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3114 canGranta rv xfdc rva) (?Q'3114 canGranta rv xfdc rva rv') [] (return rva) (?d'3114 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'3114 canGranta rv xfdc err (fst rv') err'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta rv xfdc err) (?Q''3114 canGranta rv xfdc err rv' err') [] (const (return []) err) (?d'3114 canGranta rv xfdc rv')
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>?Q3114 canGranta rv xfdc\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?r'3114 canGranta rv xfdc rv' (snd (status_' s, current_extra_caps_' (globals s))) \<longrightarrow> s \<in> ?Q'3114 canGranta rv xfdc rv' (status_' s, current_extra_caps_' (globals s))) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> ?f'3114 canGranta rv xfdc ft (fst (status_' s, current_extra_caps_' (globals s))) (errstate s) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 8. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 9. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 10. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (status_' s, current_extra_caps_' (globals s))) rv' t t' (IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (?d'3114 canGranta (message_info_to_H xfdc) xfdc rv')
 2. \<And>canGranta rv xfdc rva rv'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; interpret_excaps (snd rv') = excaps_map rva; fst rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3114 canGranta rv xfdc rva) (?Q'3114 canGranta rv xfdc rva rv') [] (return rva) (?d'3114 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta rv xfdc err) (?Q''3114 canGranta rv xfdc err rv' err') [] (const (return []) err) (?d'3114 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>?Q3114 canGranta rv xfdc\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> ?Q'3114 canGranta rv xfdc rv' (status_' s, current_extra_caps_' (globals s))) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 7. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 8. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 9. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 10. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>canGranta rv xfdc rva rv'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; interpret_excaps (snd rv') = excaps_map rva; fst rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3114 canGranta rv xfdc rva) (?Q'3114 canGranta rv xfdc rva rv') [] (return rva) (IF fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv'))
FI)
 2. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta rv xfdc err) (?Q''3114 canGranta rv xfdc err rv' err') [] (const (return []) err) (IF fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv'))
FI)
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>?Q3114 canGranta rv xfdc\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> ?Q'3114 canGranta rv xfdc rv' (status_' s, current_extra_caps_' (globals s))) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 6. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 7. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 9. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 10. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>canGranta rv xfdc rva rv'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; interpret_excaps (snd rv') = excaps_map rva; fst rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q3114 canGranta (message_info_to_H xfdc) xfdc rva) (?Q'3114 canGranta (message_info_to_H xfdc) xfdc rva rv') [] (return rva) SKIP
 2. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta rv xfdc err) (?Q''3114 canGranta rv xfdc err rv' err') [] (const (return []) err) (IF fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv'))
FI)
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>?Q3114 canGranta rv xfdc\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> ?Q'3114 canGranta rv xfdc rv' (status_' s, current_extra_caps_' (globals s))) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 6. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 7. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 9. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 10. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta rv xfdc err) (?Q''3114 canGranta rv xfdc err rv' err') [] (const (return []) err) (IF fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>globals :== current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv'))
FI)
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 5. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 6. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 9. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 10. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?QE3114 canGranta (message_info_to_H xfdc) xfdc err) (?Q''3114 canGranta (message_info_to_H xfdc) xfdc err rv' err') [] (return []) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv'))
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE3114 canGranta rv xfdc\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> ?Q''3114 canGranta rv xfdc ft (status_' s, current_extra_caps_' (globals s)) (errstate s))}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 5. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 6. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 9. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 10. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>canGranta rv xfdc err rv' err'. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C (snd rv')) 0 NULL) (snd rv') {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> interpret_excaps (current_extra_caps_' (globals s)) = excaps_map rv}
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> UNIV)}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 5. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 6. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 9. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 10. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>canGranta rv xfdc err rv' err' \<sigma>. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0; fst rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cfault_rel (Some err) (errfault err') (errlookup_fault err')\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (snd rv'))) s) \<in> rf_sr \<and> interpret_excaps (excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (snd rv')) = excaps_map rv}
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> UNIV)}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 5. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 6. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 9. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 10. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3119 canGranta (message_info_to_H xfdc)\<rbrace> lookupExtraCaps sender sendBuffer (message_info_to_H xfdc) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> UNIV)}
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 4. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 5. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 8. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and ?R3119 canGranta a) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 9. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 10. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) {s. (\<forall>rv'. fst (status_' s, current_extra_caps_' (globals s)) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> interpret_excaps (snd (status_' s, current_extra_caps_' (globals s))) = excaps_map rv' \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rv'\<rbrace>) \<and> (\<forall>ft. fst (status_' s, current_extra_caps_' (globals s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> cfault_rel (Some ft) (errfault (errstate s)) (errlookup_fault (errstate s)) \<longrightarrow> s \<in> UNIV)}
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 3. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 7. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 8. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 9. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant; rv = message_info_to_H xfdc; canGranta \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> UNIV \<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc) UNIV
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 3. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 4. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 7. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 8. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 9. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; \<not> to_bool canGranta\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 canGranta rv) (?T3100 canGranta rv xfdc) [] (return []) (Cond (if canGranta \<noteq> 0 then UNIV else {}) (\<acute>status :== CALL lookupExtraCaps_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),xfdc);;
IF \<acute>status \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  \<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps
FI) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps))
 2. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>\<not> canGrant; rv = message_info_to_H xfdc; canGranta = 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?R3104 0 (message_info_to_H xfdc)) (?T3100 0 (message_info_to_H xfdc) xfdc) [] (return []) (\<acute>current_extra_caps :== excaprefs_C_update (\<lambda>_. Arrays.update (excaprefs_C \<acute>current_extra_caps) 0 NULL) \<acute>current_extra_caps)
 2. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> ?R3104 canGranta a s)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> ?T3100 canGranta rv (tag_' s))}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>\<not> canGrant; True\<rbrakk> \<Longrightarrow> UNIV \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, globals_update (current_extra_caps_'_update (\<lambda>_. excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals sa)))) sa) \<in> rf_sr \<and> interpret_excaps (excaprefs_C_update (\<lambda>v. Arrays.update v 0 NULL) (current_extra_caps_' (globals sa))) = excaps_map []}
 2. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 3. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>canGranta rv xfdc rv' t t'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. current_extra_caps_' (globals s)) rv' t t' (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdc);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))) (?d'3096 canGranta rv xfdc rv')
 2. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (?d'3096 canGranta rv xfdca rv')
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 5. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 6. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 7. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>canGranta rv xfdca rva rv'. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?Q'3096 canGranta rv xfdca rva rv') [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>ret__unsigned :== CALL seL4_MessageInfo_get_length_'proc(xfdca);;
(\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdca,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge)))))))
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (?Q'3096 canGranta rv xfdc)
 4. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 5. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 6. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3096 canGranta rv xfdca rva) (?G'3462 canGranta rv xfdca rva rv' ret__unsigned) [SKIP] (do msgTransferred <- copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv);
tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. msgTransferred) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned);;
(\<acute>tag :== CALL transferCaps_'proc(xfdca,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) \<acute>msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))))
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>?Q3096 canGranta rv xfdc\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'3462 canGranta rv xfdc rva rv' v})
 4. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 5. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 6. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3633 canGranta rv xfdca rva rv' ret__unsigned rvb) (?Q'3633 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred) [SKIP] (do tag' <- transferCaps rv rva endpoint receiver receiveBuffer;
y <- setMessageInfo receiver (msgLength_update (\<lambda>_. rvb) tag');
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>tag :== CALL transferCaps_'proc(xfdca,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer));;
(\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(\<acute>tag,UCAST(32 \<rightarrow> 32) msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge)))))
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>?Q3633 canGranta rv xfdc rva rv' ret__unsigned\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> ?Q'3633 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc tag. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H tag\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3790 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc) (?Q'3790 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc tag) [SKIP] (do y <- setMessageInfo receiver (msgLength_update (\<lambda>_. rvb) rvc);
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>tag :== CALL seL4_MessageInfo_set_length_'proc(tag,UCAST(32 \<rightarrow> 32) msgTransferred);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))))
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>?Q3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rvc. rvc = message_info_to_H (tag_' s) \<longrightarrow> s \<in> ?Q'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc (tag_' s)}
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 5. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 8. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 9. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 10. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3790 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc) (?G'3864 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag) [SKIP] (do y <- setMessageInfo receiver (msgLength_update (\<lambda>_. rvb) rvc);
asUser receiver (setRegister Notification_H.badgeRegister badge)
od) (\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(tag);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge)))
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>?Q3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rvc. rvc = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> ?G'3864 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc (tag_' s) v}}
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 5. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 8. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 9. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 10. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (12 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag y xfdcb. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>; dc y xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3961 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag y) (?Q'3961 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag y xfdcb) [SKIP] (asUser receiver (setRegister Notification_H.badgeRegister badge)) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,badge))
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc taga tag. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R3963 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc\<rbrace> setMessageInfo receiver (msgLength_update (\<lambda>_. rvb) rvc) \<lbrace>?Q3961 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc taga tag\<rbrace>
 3. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag s rvd. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'3961 canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag rvd (xfdc s)
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>\<lambda>rvc. tcb_at' receiver and ?R3963 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc\<rbrace>
 5. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> \<lbrace>msgLength_update (\<lambda>_. rvb) rv = message_info_to_H v\<rbrace>}}
 6. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 7. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 9. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 10. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc taga tag. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R3963 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc\<rbrace> setMessageInfo receiver (msgLength_update (\<lambda>_. rvb) rvc) \<lbrace>\<lambda>y _. True\<rbrace>
 2. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag s rvd. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>}
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>\<lambda>rvc. tcb_at' receiver and ?R3963 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred rvc\<rbrace>
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> \<lbrace>msgLength_update (\<lambda>_. rvb) rv = message_info_to_H v\<rbrace>}}
 5. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 6. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 8. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 9. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 10. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>canGranta rv xfdca rva rv' ret__unsigned rvb msgTransferred rvc taga tag s rvd. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdca; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdca); rvb = msgTransferred && mask msgLengthBits; rvc = message_info_to_H taga; seL4_MessageInfo_lift tag = seL4_MessageInfo_lift taga\<lparr>length_CL := msgTransferred && mask 7\<rparr>; dc rvd (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. w_'_update (\<lambda>_. badge) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = badge\<rbrace>}
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>\<lambda>rvc. tcb_at' receiver and (\<lambda>a. True)\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> \<lbrace>msgLength_update (\<lambda>_. rvb) rv = message_info_to_H v\<rbrace>}}
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 5. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 7. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 8. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 9. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 10. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<lbrace>?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace> transferCaps rv rva endpoint receiver receiveBuffer \<lbrace>\<lambda>rvc. tcb_at' receiver and (\<lambda>a. True)\<rbrace>
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> \<lbrace>msgLength_update (\<lambda>_. rvb) rv = message_info_to_H v\<rbrace>}}
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and ?R3792 canGranta rv xfdc rva rv' ret__unsigned rvb\<rbrace>
 4. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 6. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 7. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 8. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 9. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc); rvb = msgTransferred && mask msgLengthBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) {s. \<forall>rv. rv = message_info_to_H (tag_' s) \<longrightarrow> s \<in> {sa. \<forall>v. seL4_MessageInfo_lift v = seL4_MessageInfo_lift (seL4_MessageInfo_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)))\<lparr>length_CL := v32_' (v32_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) msgTransferred) (seL4_MessageInfo_'_update (\<lambda>_. tag_' s) sa)) && mask 7\<rparr> \<longrightarrow> tag_'_update (\<lambda>_. v) sa \<in> UNIV \<inter> \<lbrace>msgLength_update (\<lambda>_. rvb) rv = message_info_to_H v\<rbrace>}}
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and (\<lambda>s. tcb_at' receiver s \<and> True)\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned rvb msgTransferred. \<lbrakk>canGrant = to_bool canGranta; rv = Types_H.message_info.MI (seL4_MessageInfo_C.words_C xfdc.[0] && mask 7) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 7) && mask 2) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 9) && mask 3) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 12) && mask 20); interpret_excaps rv' = excaps_map rva; ret__unsigned = seL4_MessageInfo_C.words_C xfdc.[0] && mask 7; rvb = msgTransferred && mask 7\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3790 canGranta (Types_H.message_info.MI (seL4_MessageInfo_C.words_C xfdc.[0] && mask 7) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 7) && mask 2) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 9) && mask 3) ((seL4_MessageInfo_C.words_C xfdc.[0] >> 12) && mask 20)) xfdc rva rv' (seL4_MessageInfo_C.words_C xfdc.[0] && mask 7) (msgTransferred && mask 7) msgTransferred) \<acute>tag :== CALL transferCaps_'proc(xfdc,option_to_ptr endpoint,tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer)) UNIV
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and (\<lambda>s. tcb_at' receiver s \<and> True)\<rbrace>
 3. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> ?R'3790 canGranta rv xfdc rva rv' ret__unsigned rvb (msgTransferred_' s)}
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 5. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 6. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 7. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 8. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<lbrace>?R3635 canGranta rv xfdc rva\<rbrace> copyMRs sender sendBuffer receiver receiveBuffer (msgLength rv) \<lbrace>\<lambda>rvb. valid_pspace' and tcb_at' receiver and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and excaps_in_mem rva \<circ> ctes_of and K (length rva \<le> 3) and K (endpoint \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgExtraCaps rv) \<le> 3) and (\<lambda>s. tcb_at' receiver s \<and> True)\<rbrace>
 2. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and ?R3635 canGranta rv xfdc rva\<rbrace>
 4. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 5. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 6. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 7. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>canGranta rv xfdc rva rv' ret__unsigned. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc; interpret_excaps rv' = excaps_map rva; ret__unsigned = length_CL (seL4_MessageInfo_lift xfdc)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta rv xfdc rva rv' ret__unsigned) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),UCAST(32 \<rightarrow> 32) ret__unsigned) {s. \<forall>rvb. rvb = msgTransferred_' s && mask msgLengthBits \<longrightarrow> s \<in> {s. receiveBuffer_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (endpoint_'_update (\<lambda>_. option_to_ptr endpoint) (info_'_update (\<lambda>_. xfdc) s))) \<in> UNIV \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>rv = message_info_to_H \<acute>info\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem rva (ctes_of s) \<and> length rva \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps rv) \<le> 3 \<and> tcb_at' receiver s)\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 4. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 5. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 6. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>canGranta xfdc rva rv'. \<lbrakk>canGrant = to_bool canGranta; interpret_excaps rv' = excaps_map rva\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3633 canGranta (message_info_to_H xfdc) xfdc rva rv' (length_CL (seL4_MessageInfo_lift xfdc))) \<acute>msgTransferred :== CALL copyMRs_'proc(tcb_ptr_to_ctcb_ptr sender,PTR(32 word) (option_to_0 sendBuffer),tcb_ptr_to_ctcb_ptr receiver,PTR(32 word) (option_to_0 receiveBuffer),length_CL (seL4_MessageInfo_lift xfdc)) \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace>
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem rva (ctes_of s) \<and> length rva \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps rv) \<le> 3 \<and> tcb_at' receiver s)\<rbrace>
 3. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> ?R'3633 canGranta rv xfdc rva rv' v})
 4. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 5. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 6. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R3099 canGranta rv\<rbrace> if to_bool canGranta then lookupExtraCaps sender sendBuffer rv `~catchFailure~` const (return []) else return [] \<lbrace>\<lambda>rva. valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (receiveBuffer \<noteq> Some 0) and K (unat (msgLength rv) \<le> msgMaxLength) and (\<lambda>s. valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem rva (ctes_of s) \<and> length rva \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps rv) \<le> 3 \<and> tcb_at' receiver s)\<rbrace>
 2. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace>})
 3. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and ?R3099 canGranta a\<rbrace>
 4. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 5. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>canGranta rv xfdc. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>c c'. interpret_excaps c' = excaps_map c) (\<lambda>s. current_extra_caps_' (globals s)) (\<lambda>rva rv'. {s. \<forall>v. v = length_CL (seL4_MessageInfo_lift (seL4_MessageInfo_' (seL4_MessageInfo_'_update (\<lambda>_. xfdc) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. n_'_update (\<lambda>_. UCAST(32 \<rightarrow> 32) v) (recvBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 receiveBuffer)) (receiver_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) (sendBuf_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (sender_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = msgLength rv\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>} \<inter> \<lbrace>interpret_excaps \<acute>current_extra_caps = excaps_map rva\<rbrace>})
 2. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and (\<lambda>s. (to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> True \<and> unat (msgExtraCaps a) \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s) \<and> (\<not> to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> K (sendBuffer \<noteq> Some 0) s \<and> K (receiveBuffer \<noteq> Some 0) s \<and> K (unat (msgLength a) \<le> msgMaxLength) s \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s))\<rbrace>
 3. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 4. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>canGranta xfdc s rva. \<lbrakk>canGrant = to_bool canGranta; interpret_excaps (current_extra_caps_' (globals s)) = excaps_map rva\<rbrakk> \<Longrightarrow> length_CL (seL4_MessageInfo_lift xfdc) = length_CL (seL4_MessageInfo_lift xfdc) && mask msgLengthBits \<and> length_CL (seL4_MessageInfo_lift xfdc) = msgLength (message_info_to_H xfdc)
 2. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and (\<lambda>s. (to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> True \<and> unat (msgExtraCaps a) \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s) \<and> (\<not> to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> K (sendBuffer \<noteq> Some 0) s \<and> K (receiveBuffer \<noteq> Some 0) s \<and> K (unat (msgLength a) \<le> msgMaxLength) s \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s))\<rbrace>
 3. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 4. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>canGranta. canGrant = to_bool canGranta \<Longrightarrow> \<lbrace>?R2898 (option_to_ptr endpoint) badge canGranta (PTR(32 word) (option_to_0 receiveBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> getMessageInfo sender \<lbrace>\<lambda>a. (\<lambda>s. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>s. unat (msgExtraCaps a) \<le> 3) and (\<lambda>a. True \<and> True)) s) \<and> (\<not> to_bool canGranta \<longrightarrow> True)) and (\<lambda>s. (to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s \<and> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgLength a) \<le> msgMaxLength \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> True \<and> unat (msgExtraCaps a) \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s) \<and> (\<not> to_bool canGranta \<longrightarrow> valid_pspace' s \<and> tcb_at' sender s \<and> tcb_at' receiver s \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> K (sendBuffer \<noteq> Some 0) s \<and> K (receiveBuffer \<noteq> Some 0) s \<and> K (unat (msgLength a) \<le> msgMaxLength) s \<and> valid_pspace' s \<and> tcb_at' receiver s \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) s \<and> excaps_in_mem [] (ctes_of s) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> unat (msgExtraCaps a) \<le> 3 \<and> tcb_at' receiver s))\<rbrace>
 2. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> s \<in> {sa. (to_bool canGranta \<longrightarrow> sa \<in> {sa. info_'_update (\<lambda>_. tag_' s) (bufferPtr_'_update (\<lambda>_. PTR(32 word) (option_to_0 sendBuffer)) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>bufferPtr = option_to_ptr sendBuffer\<rbrace> \<inter> \<lbrace>seL4_MessageInfo_lift \<acute>info = mi_from_H rv\<rbrace>} \<inter> UNIV) \<and> (\<not> to_bool canGranta \<longrightarrow> sa \<in> UNIV)}
 3. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and ?R2898 endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> to_bool canGranta \<longrightarrow> s \<in> (if PTR(32 word) (option_to_0 sendBuffer) = option_to_ptr sendBuffer \<and> seL4_MessageInfo_lift (tag_' s) = mi_from_H (message_info_to_H (tag_' s)) then UNIV else {})
 2. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and (\<lambda>a. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) a \<and> True \<and> True \<and> True) \<and> (\<not> to_bool canGranta \<longrightarrow> True) \<and> (to_bool canGranta \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> excaps_in_mem [] (ctes_of a) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a \<and> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> True \<and> True \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a) \<and> (\<not> to_bool canGranta \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> K (sendBuffer \<noteq> Some 0) a \<and> K (receiveBuffer \<noteq> Some 0) a \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> excaps_in_mem [] (ctes_of a) \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a))) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>canGranta s rv. \<lbrakk>canGrant = to_bool canGranta; rv = message_info_to_H (tag_' s)\<rbrakk> \<Longrightarrow> to_bool canGranta \<longrightarrow> PTR(32 word) (option_to_0 sendBuffer) = option_to_ptr sendBuffer \<and> seL4_MessageInfo_lift (tag_' s) = mi_from_H (message_info_to_H (tag_' s))
 2. \<And>endpointa badgea canGranta receiveBuffera sendBuffera receivera sendera s s'. \<lbrakk>endpointa = option_to_ptr endpoint; badgea = badge; canGrant = to_bool canGranta; receiveBuffera = PTR(32 word) (option_to_0 receiveBuffer); sendBuffera = PTR(32 word) (option_to_0 sendBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and (\<lambda>y. endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (tcb_at' sender and (\<lambda>a. (to_bool canGranta \<longrightarrow> (valid_pspace' and tcb_at' sender and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) a \<and> True \<and> True \<and> True) \<and> (\<not> to_bool canGranta \<longrightarrow> True) \<and> (to_bool canGranta \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> excaps_in_mem [] (ctes_of a) \<and> length [] \<le> 3 \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a \<and> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> sendBuffer \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> True \<and> True \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a) \<and> (\<not> to_bool canGranta \<longrightarrow> valid_pspace' a \<and> tcb_at' sender a \<and> tcb_at' receiver a \<and> (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) a \<and> K (sendBuffer \<noteq> Some 0) a \<and> K (receiveBuffer \<noteq> Some 0) a \<and> True \<and> valid_pspace' a \<and> tcb_at' receiver a \<and> (case receiveBuffer of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a \<and> excaps_in_mem [] (ctes_of a) \<and> endpoint \<noteq> Some 0 \<and> receiveBuffer \<noteq> Some 0 \<and> True \<and> tcb_at' receiver a))) s \<and> s' \<in> UNIV proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (valid_pspace' and cur_tcb' and tcb_at' sender and tcb_at' receiver and K (endpoint \<noteq> Some 0) and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case receiveBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>sendBuffer = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>receiveBuffer = PTR(32 word) (option_to_0 receiveBuffer)\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>canGrant\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr endpoint\<rbrace>) [] (doNormalTransfer sender sendBuffer endpoint badge canGrant receiver receiveBuffer) (Call doNormalTransfer_'proc)

goal:
No subgoals!