theory Fastpath_Equiv

lemma fastpath_callKernel_SysReplyRecv_corres:
  "monadic_rewrite True False
     (invs' and ct_in_state' ((=) Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)
         and cnode_caps_gsCNodes')
     (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv)" including no_pre supply if_cong[cong] option.case_cong[cong] supply if_split[split del] supply user_getreg_inv[wp]  (* FIXME *)
   apply (rule monadic_rewrite_introduce_alternative[OF callKernel_def[simplified atomize_eq]]) apply (rule monadic_rewrite_guard_imp) apply (rule monadic_rewrite_bind_alternative_l, wpsimp) apply (rule monadic_rewrite_stateAssert) apply (simp add: handleEvent_def handleReply_def
                    handleRecv_def liftE_bindE_handle liftE_handle
                    bind_assoc getMessageInfo_def liftE_bind) apply (simp add: catch_liftE_bindE unlessE_throw_catch_If
                    unifyFailure_catch_If catch_liftE
                    getMessageInfo_def alternative_bind
                    fastpaths_def getThreadCallerSlot_def
                    locateSlot_conv capability_case_Null_ReplyCap
                    getThreadCSpaceRoot_def
              cong: if_cong) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply monadic_rewrite_symb_exec_r apply (rename_tac msgInfo) apply monadic_rewrite_symb_exec_r apply monadic_rewrite_symb_exec_r apply (rename_tac tcbFault) apply (rule monadic_rewrite_alternative_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: lookupCap_def liftME_def lookupCapAndSlot_def
                        lookupSlotForThread_def bindE_assoc
                        split_def getThreadCSpaceRoot_def
                        locateSlot_conv liftE_bindE bindE_bind_linearise
                        capFaultOnFailure_def rethrowFailure_injection
                        injection_handler_catch bind_bindE_assoc
                        getThreadCallerSlot_def bind_assoc
                        getSlotCap_def case_bool_If
                        isRight_def[where x="Inr v" for v]
                        isRight_def[where x="Inl v" for v]
                  cong: if_cong) apply monadic_rewrite_symb_exec_r apply (rename_tac "cTableCTE") apply (rule monadic_rewrite_transverse,
               monadic_rewrite_l resolveAddressBitsFn_eq wpsimp, rule monadic_rewrite_refl) apply monadic_rewrite_symb_exec_r apply (rename_tac "rab_ret") apply (rule_tac P="isRight rab_ret" in monadic_rewrite_cases[rotated]) apply (case_tac rab_ret, simp_all add: isRight_def)[1] apply (rule monadic_rewrite_alternative_l) apply clarsimp apply (simp add: isRight_case_sum liftE_bind
                          isRight_def[where x="Inr v" for v]) apply monadic_rewrite_symb_exec_r apply (rename_tac ep_cap) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (monadic_rewrite_symb_exec
                   \<open>rule monadic_rewrite_symb_exec_r_nE[OF _ _ _ active_ntfn_check_wp, unfolded bind_assoc fun_app_def]\<close>
                   \<open>wpsimp simp: getBoundNotification_def wp: threadGet_wp\<close>) apply (rename_tac ep) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply (rename_tac ep) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_bind_alternative_l, wp) apply (rule monadic_rewrite_bind_tail) apply (rename_tac replyCTE) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: bind_assoc) apply (rule monadic_rewrite_bind_alternative_l, wp assert_inv) apply (rule monadic_rewrite_assert) apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (simp add: getThreadVSpaceRoot_def locateSlot_conv) apply monadic_rewrite_symb_exec_r apply (rename_tac vTableCTE) apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply monadic_rewrite_symb_exec_r apply (simp add: isHighestPrio_def') apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply monadic_rewrite_symb_exec_r apply (rule monadic_rewrite_if_r[rotated]) apply (rule monadic_rewrite_alternative_l) apply (rule monadic_rewrite_trans,
                              rule monadic_rewrite_pick_alternative_1) 
                   (* now committed to fastpath *)
                    apply (rule_tac P="\<lambda>v.  obj_at' (%tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE))"
                         in monadic_rewrite_exists_v) apply (rename_tac ipcBuffer) apply (simp add: ARM_H.switchToThread_def bind_assoc) apply (rule monadic_rewrite_trans[OF _ monadic_rewrite_transverse]) apply (rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp mapM_x_wp' getObject_inv | wpc | simp add:
                            | wp (once) hoare_drop_imps )+ apply (rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp setCTE_obj_at'_tcbIPCBuffer assert_inv mapM_x_wp' getObject_inv | wpc | simp
                                 | wp (once) hoare_drop_imps )+ apply (rule monadic_rewrite_trans) apply (rule monadic_rewrite_trans) apply (rule monadic_rewrite_bind_head) apply (rule monadic_rewrite_trans) apply (rule doReplyTransfer_simple) apply simp apply (((rule monadic_rewrite_weaken_flags',
                             (rule_tac msgInfo=msgInfo in doIPCTransfer_simple_rewrite
                           | rule_tac destPrio=callerPrio
                                            and curDom=curDom and destDom=callerDom
                                            and thread=thread in possibleSwitchTo_rewrite))
                           | rule cteDeleteOne_replycap_rewrite
                           | rule monadic_rewrite_bind monadic_rewrite_refl
                           | wp assert_inv mapM_x_wp'
                                setThreadState_obj_at_unchanged
                                asUser_obj_at_unchanged
                                hoare_strengthen_post[OF _ obj_at_conj'[simplified atomize_conjL], rotated]
                                 lookupBitmapPriority_lift
                                 setThreadState_runnable_bitmap_inv
                           | simp add: setMessageInfo_def setThreadState_runnable_simp
                           | wp (once) hoare_vcg_disj_lift)+)[1] apply (simp add: setMessageInfo_def) apply (rule monadic_rewrite_bind_tail) apply (rename_tac unblocked) apply (monadic_rewrite_symb_exec_l_known thread) apply (monadic_rewrite_symb_exec_l_known cptr) apply (rule monadic_rewrite_bind) apply (rule monadic_rewrite_catch[OF _ monadic_rewrite_refl True_E_E]) apply monadic_rewrite_symb_exec_l apply (rename_tac cTableCTE2,
                                 rule_tac P="cteCap cTableCTE2 = cteCap cTableCTE"
                                   in monadic_rewrite_gen_asm) apply simp apply (rule monadic_rewrite_trans,
                                 rule monadic_rewrite_bindE[OF _ monadic_rewrite_refl]) apply (rule_tac slot="\<lambda>s. ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot"
                                     in resolveAddressBitsFn_eq_name_slot) apply wp apply (rule monadic_rewrite_trans) apply (rule_tac rv=rab_ret
                                    in monadic_rewrite_gets_known[where m="Nondet_Monad.lift f"
                                    for f, folded bindE_def]) apply (simp add: Nondet_Monad.lift_def isRight_case_sum) apply monadic_rewrite_symb_exec_l apply (rename_tac ep_cap2) apply (rule_tac P="cteCap ep_cap2 = cteCap ep_cap" in monadic_rewrite_gen_asm) apply (simp add: cap_case_EndpointCap_NotificationCap) apply (rule monadic_rewrite_liftE) apply (rule monadic_rewrite_trans) apply (rule monadic_rewrite_bind) apply (rule deleteCallerCap_nullcap_rewrite) apply (rule_tac ep=ep in receiveIPC_simple_rewrite) apply (wp, simp) apply (rule monadic_rewrite_bind_head) apply (rule monadic_rewrite_weaken_flags[where E=True and F=True], simp) apply (rule setThreadState_rewrite_simple) apply clarsimp apply (wp getCTE_known_cap)+ apply (rule monadic_rewrite_bind) apply (rule_tac t="capTCBPtr (cteCap replyCTE)"
                                      and t'=thread
                                       in schedule_known_rewrite) apply (rule monadic_rewrite_weaken_flags[where E=True and F=True], simp) apply (rule monadic_rewrite_bind) apply (rule activateThread_simple_rewrite) apply (rule monadic_rewrite_refl) apply wp apply wp apply (simp add: ct_in_state'_def, simp add: ct_in_state'_def[symmetric]) apply ((wp setCurThread_ct_in_state[folded st_tcb_at'_def]
                                    Arch_switchToThread_pred_tcb')+)[2] apply (simp add: catch_liftE) apply ((wpsimp wp: user_getreg_rv setEndpoint_obj_at_tcb'
                                          threadSet_pred_tcb_at_state[unfolded if_bool_eq_conj]
                                          fastpathBestSwitchCandidate_lift[where f="setEndpoint a b" for a b]
                                          fastpathBestSwitchCandidate_lift[where f="threadSet f t" for f t]
                               | wps)+)[3] apply (simp cong: rev_conj_cong) apply (wpsimp wp: seThreadState_tcbContext[simplified comp_apply]
                                      setThreadState_oa_queued user_getreg_rv
                                      setThreadState_no_sch_change setThreadState_obj_at_unchanged
                                      sts_st_tcb_at'_cases sts_bound_tcb_at'
                                      fastpathBestSwitchCandidate_lift[where f="setThreadState s t" for s t]
                                      hoare_weak_lift_imp hoare_vcg_all_lift hoare_vcg_imp_lift
                                      hoare_weak_lift_imp cnode_caps_gsCNodes_lift
                                      hoare_vcg_ex_lift
                          | wps)+ apply (strengthen imp_consequent[where Q="tcb_at' t s" for t s]) apply ((wp setThreadState_oa_queued user_getreg_rv setThreadState_no_sch_change
                                      setThreadState_obj_at_unchanged
                                      sts_st_tcb_at'_cases sts_bound_tcb_at'
                                      emptySlot_obj_at'_not_queued emptySlot_obj_at_ep
                                      emptySlot_tcbContext[simplified comp_apply]
                                      emptySlot_cte_wp_at_cteCap
                                      emptySlot_cnode_caps
                                      user_getreg_inv asUser_typ_ats
                                      asUser_obj_at_not_queued asUser_obj_at' mapM_x_wp'
                                      hoare_weak_lift_imp hoare_vcg_all_lift hoare_vcg_imp_lift
                                      hoare_weak_lift_imp cnode_caps_gsCNodes_lift
                                      hoare_vcg_ex_lift
                                      fastpathBestSwitchCandidate_lift[where f="emptySlot a b" for a b]
                                   | simp del: comp_apply
                                   | clarsimp simp: obj_at'_weakenE[OF _ TrueI]
                                   | wps)+) apply (wpsimp wp: fastpathBestSwitchCandidate_lift[where f="asUser a b" for a b])+ apply (clarsimp cong: conj_cong) apply ((wp user_getreg_inv asUser_typ_ats
                                      asUser_obj_at_not_queued asUser_obj_at' mapM_x_wp'
                                      hoare_weak_lift_imp hoare_vcg_all_lift hoare_vcg_imp_lift
                                      hoare_weak_lift_imp cnode_caps_gsCNodes_lift
                                      hoare_vcg_ex_lift
                                   | clarsimp simp: obj_at'_weakenE[OF _ TrueI]
                                   | solves \<open>
                                       wp fastpathBestSwitchCandidate_lift[where f="asUser a b" for a b]
                                       \<close>)+) apply (clarsimp | wp getCTE_wp' gts_imp')+ apply (simp add: ARM_H.switchToThread_def bind_assoc) apply (rule monadic_rewrite_trans[OF _ monadic_rewrite_transverse]) apply (rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp mapM_x_wp' handleFault_obj_at'_tcbIPCBuffer getObject_inv | wpc | simp
                                       | wp (once) hoare_drop_imps )+ apply (rule monadic_rewrite_bind monadic_rewrite_refl)+ apply (wp setCTE_obj_at'_tcbIPCBuffer assert_inv mapM_x_wp' getObject_inv | wpc | simp
                                 | wp (once) hoare_drop_imps )+ apply (simp add: bind_assoc catch_liftE
                                    receiveIPC_def Let_def liftM_def
                                    setThreadState_runnable_simp) apply monadic_rewrite_symb_exec_l apply (rule monadic_rewrite_assert) apply (rule_tac P="inj (case_bool thread (capTCBPtr (cteCap replyCTE)))"
                                    in monadic_rewrite_gen_asm) apply (rule monadic_rewrite_trans[OF _ monadic_rewrite_transverse]) apply (rule monadic_rewrite_weaken_flags[where F=False and E=True], simp) apply (rule isolate_thread_actions_rewrite_bind
                                  fastpath_isolate_rewrites fastpath_isolatables
                                  bool.simps setRegister_simple
                                  zipWithM_setRegister_simple
                                  thread_actions_isolatable_bind
                                  thread_actions_isolatableD[OF setCTE_isolatable]
                                  setCTE_isolatable
                                  setVMRoot_isolatable[THEN thread_actions_isolatableD] setVMRoot_isolatable
                                  doMachineOp_isolatable[THEN thread_actions_isolatableD] doMachineOp_isolatable
                                  kernelExitAssertions_isolatable[THEN thread_actions_isolatableD]
                                  kernelExitAssertions_isolatable
                           | assumption
                           | wp assert_inv)+ apply (simp only: ) apply (rule_tac P="(\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)
                                       and tcb_at' thread
                                       and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte))
                                                (thread + 2 ^ cte_level_bits * tcbCallerSlot)
                                       and (\<lambda>s. \<forall>x. tcb_at' (case_bool thread (capTCBPtr (cteCap replyCTE)) x) s)
                                       and valid_mdb')"
                                and F=True and E=False in monadic_rewrite_weaken_flags) apply (rule monadic_rewrite_isolate_final2) apply simp apply monadic_rewrite_symb_exec_l apply (rename_tac callerCTE) apply (rule monadic_rewrite_assert) apply monadic_rewrite_symb_exec_l apply (rule monadic_rewrite_assert) apply (simp add: emptySlot_setEndpoint_pivot) apply (rule monadic_rewrite_bind) apply (rule monadic_rewrite_is_refl) apply (clarsimp simp: isSendEP_def split: Structures_H.endpoint.split) apply (monadic_rewrite_symb_exec_r_known callerCTE) apply (rule monadic_rewrite_trans, rule monadic_rewrite_bind_head,
                                       rule_tac cte=callerCTE in emptySlot_replymaster_rewrite) apply (simp add: bind_assoc o_def) apply (rule monadic_rewrite_refl) apply (simp add: cte_wp_at_ctes_of pred_conj_def) apply (clarsimp | wp getCTE_ctes_wp)+ apply (clarsimp simp: zip_map2 zip_same_conv_map foldl_map
                                            foldl_fun_upd
                                            foldr_copy_register_tsrs
                                            isRight_case_sum
                                      cong: if_cong) apply (clarsimp simp: fun_eq_iff if_flip
                                      cong: if_cong) apply (drule obj_at_ko_at', clarsimp) apply (frule get_tcb_state_regs_ko_at') apply (clarsimp simp: zip_map2 zip_same_conv_map foldl_map
                                            foldl_fun_upd
                                            foldr_copy_register_tsrs
                                            isRight_case_sum
                                      cong: if_cong) apply (simp add: upto_enum_def fromEnum_def
                                       enum_register toEnum_def
                                       msgRegisters_unfold
                                 cong: if_cong) apply (clarsimp split: if_split) apply (rule ext) apply (simp add: badgeRegister_def msgInfoRegister_def
                                       ARM.msgInfoRegister_def
                                       ARM.badgeRegister_def
                                 cong: if_cong
                                split: if_split) apply simp apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps
                                          map_to_ctes_partial_overwrite) apply (simp add: valid_mdb'_def valid_mdb_ctes_def) apply simp apply (simp cong: if_cong bool.case_cong
                          | rule getCTE_wp' gts_wp' threadGet_wp
                                 getEndpoint_wp gets_wp
                                 user_getreg_wp
                                 gets_the_wp gct_wp getNotification_wp
                                 return_wp liftM_wp gbn_wp'
                          | (simp only: curDomain_def, wp)[1])+ apply clarsimp apply (subgoal_tac "ksCurThread s \<noteq> ksIdleThread s") prefer 2 apply (fastforce simp: ct_in_state'_def dest: ct_running_not_idle' elim: pred_tcb'_weakenE) apply (clarsimp simp: ct_in_state'_def pred_tcb_at') apply (subst tcb_at_cte_at_offset,
         erule obj_at'_weakenE[OF _ TrueI],
         simp add: tcb_cte_cases_def cte_level_bits_def tcbSlots) apply (clarsimp simp: valid_objs_ntfn_at_tcbBoundNotification
                        invs_valid_objs' if_apply_def2) apply (rule conjI[rotated]) apply (fastforce elim: cte_wp_at_weakenE') apply (clarsimp simp: isRight_def) apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp+) apply (frule resolveAddressBitsFn_real_cte_at',
    (clarsimp | erule cte_wp_at_weakenE')+) apply (frule real_cte_at', clarsimp) apply (frule cte_wp_at_valid_objs_valid_cap', clarsimp,
         clarsimp simp: isCap_simps, simp add: valid_cap_simps') apply (clarsimp simp: maskCapRights_def isCap_simps) apply (frule_tac p="p' + 2 ^ cte_level_bits * tcbCallerSlot" for p'
              in cte_wp_at_valid_objs_valid_cap', clarsimp+) apply (clarsimp simp: valid_cap_simps') apply (subst tcb_at_cte_at_offset,
         assumption, simp add: tcb_cte_cases_def cte_level_bits_def tcbSlots) apply (clarsimp simp: inj_case_bool cte_wp_at_ctes_of
                        length_msgRegisters
                        order_less_imp_le
                        tcb_at_invs' invs_mdb'
                 split: bool.split) apply (subst imp_disjL[symmetric], intro allI impI) apply (clarsimp simp: inj_case_bool cte_wp_at_ctes_of
                        length_msgRegisters size_msgRegisters_def order_less_imp_le
                        tcb_at_invs' invs_mdb'
                 split: bool.split) apply (subgoal_tac "fastpathBestSwitchCandidate v0a s") prefer 2 apply normalise_obj_at' apply (rule_tac ttcb=tcba and ctcb=tcb in fastpathBestSwitchCandidateI) apply (erule disjE, blast, blast) apply simp+ apply (clarsimp simp: obj_at_tcbs_of tcbSlots
                        cte_level_bits_def) apply (frule(1) st_tcb_at_is_Reply_imp_not_tcbQueued) apply (auto simp: obj_at_tcbs_of tcbSlots
                        cte_level_bits_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (1 subgoal):
 1. monadic_rewrite True False (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) (do stateAssert fastpathKernelAssertions [];
runExceptT $ handleEvent (SyscallEvent SysReplyRecv) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?Q3 (do stateAssert fastpathKernelAssertions [];
runExceptT $ handleEvent (SyscallEvent SysReplyRecv) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> ?Q3 s proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?Q3 (do x <- stateAssert fastpathKernelAssertions [];
K_bind (do runExceptT $ handleEvent (SyscallEvent SysReplyRecv) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od) x \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od) (fastpaths SysReplyRecv)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> ?Q3 s proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (K_bind (do runExceptT $ handleEvent (SyscallEvent SysReplyRecv) `~catchError~` (\<lambda>_. withoutPreemption $ do irq <- doMachineOp (getActiveIRQ True);
when (isJust irq) $ handleInterrupt (fromJust irq)
od);
ThreadDecls_H.schedule;
activateThread;
stateAssert kernelExitAssertions []
od) () \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
callerSlot <- getThreadCallerSlot thread;
x <- getSlotCap callerSlot;
y <- case x of capability.NullCap \<Rightarrow> return () | capability.ReplyCap caller True canGrant \<Rightarrow> haskell_fail [] | capability.ReplyCap caller False canGrant \<Rightarrow> do haskell_assert (caller \<noteq> thread) [];
doReplyTransfer thread caller callerSlot canGrant
od | _ \<Rightarrow> fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (fastpaths SysReplyRecv)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do curThread <- getCurThread;
x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (curThread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (2 subgoals):
 1. monadic_rewrite True False ?P13 (do thread <- getCurThread;
do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od) (do curThread <- getCurThread;
x <- asUser curThread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser curThread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault curThread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (curThread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification curThread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) curThread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [curThread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [curThread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (curThread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser curThread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (3 subgoals):
 1. \<And>thread. monadic_rewrite True False (?Q60 thread) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do x <- asUser thread (getRegister TCB_H.msgInfoRegister);
cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>?Q60\<rbrace>
 3. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (4 subgoals):
 1. \<And>thread x. monadic_rewrite True False (?Q64 thread x) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord x) = 0 \<and> msgLength (messageInfoFromWord x) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord x))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord x))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q64 thread\<rbrace>
 3. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 4. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (4 subgoals):
 1. \<And>thread msgInfo. monadic_rewrite True False (?Q64 thread msgInfo) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do cptr <- asUser thread (getRegister Thread_H.capRegister);
fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>?Q64 thread\<rbrace>
 3. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 4. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (5 subgoals):
 1. \<And>thread msgInfo cptr. monadic_rewrite True False (?Q94 thread msgInfo cptr) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do fault <- threadGet tcbFault thread;
(if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>?Q94 thread msgInfo\<rbrace>
 3. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 4. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 5. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo cptr fault. monadic_rewrite True False (?Q124 thread msgInfo cptr fault) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) ((if fault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>?Q124 thread msgInfo cptr\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo cptr tcbFaulta. monadic_rewrite True False (?Q124 thread msgInfo cptr tcbFaulta) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) ((if tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)) \<sqinter> callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>?Q124 thread msgInfo cptr\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo cptr tcbFault. monadic_rewrite True False (?Q152 thread msgInfo cptr tcbFault) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr tcbFaulta. monadic_rewrite True False (?P152 thread msgInfo cptr tcbFaulta) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 3. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. ?P152 thread msgInfo cptr tcbFault and ?Q152 thread msgInfo cptr tcbFault\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo cptr tcbFaulta. monadic_rewrite True False (?P152 thread msgInfo cptr tcbFaulta) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters then do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. ?P152 thread msgInfo cptr tcbFault and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo cptr tcbFault. \<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<Longrightarrow> monadic_rewrite True False (?R156 thread msgInfo cptr tcbFault) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr tcbFaulta. tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q156 thread msgInfo cptr tcbFaulta) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q156 thread msgInfo cptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> ?R156 thread msgInfo cptr tcbFault s)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo cptr tcbFaulta. tcbFaulta = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q156 thread msgInfo cptr tcbFaulta) (do x <- getSlotCap (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap x then case capReplyMaster x of True \<Rightarrow> haskell_fail [] | False \<Rightarrow> do haskell_assert (capTCBPtr x \<noteq> thread) [];
doReplyTransfer thread (capTCBPtr x) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant x)
od else if x = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- capFaultOnFailure epCPtr True (doE epCap <- lookupCap thread epCPtr;
case epCap of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread epCap True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread epCap True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
odE) <catch> handleFault thread;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
rv <- doE t <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
liftE (getSlotCap (fst t))
odE;
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do newVTable <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE)) >>= getCTE;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q156 thread msgInfo cptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (6 subgoals):
 1. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q156 thread msgInfo cptr None) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do ctab <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr) >>= case_sum ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) (\<lambda>rv. do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
od)
 2. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> ?Q156 thread msgInfo cptr tcbFault s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 3. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 4. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 5. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 6. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo cptr ctab. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q177 thread msgInfo cptr ctab) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do a <- CSpace_H.resolveAddressBits (cteCap ctab) cptr (size cptr);
case a of Inl a \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) a | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od
od)
 2. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q177 thread msgInfo cptr\<rbrace>
 3. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q177 thread msgInfo cptr cTableCTE) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do a <- CSpace_H.resolveAddressBits (cteCap cTableCTE) cptr (size cptr);
case a of Inl a \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) a | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od
od)
 2. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q177 thread msgInfo cptr\<rbrace>
 3. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (7 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?P219 thread msgInfo cptr cTableCTE) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do a <- gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of);
case a of Inl a \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) a | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od
od)
 2. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P219 thread msgInfo cptr cTableCTE and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 3. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 4. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 5. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 6. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 7. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rv. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q234 thread msgInfo cptr cTableCTE rv) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rv of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>?Q234 thread msgInfo cptr cTableCTE\<rbrace>
 3. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 4. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> monadic_rewrite True False (?Q234 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>?Q234 thread msgInfo cptr cTableCTE\<rbrace>
 3. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 4. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> isRight rab_ret\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rab_ret\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> ?Q265 thread msgInfo cptr cTableCTE rab_ret s) \<and> (\<not> isRight rab_ret \<longrightarrow> ?R265 thread msgInfo cptr cTableCTE rab_ret s)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret a. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; rab_ret = Inl a\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R265 thread msgInfo cptr cTableCTE (Inl a)) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rab_ret\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> ?Q265 thread msgInfo cptr cTableCTE rab_ret s) \<and> (\<not> isRight rab_ret \<longrightarrow> ?R265 thread msgInfo cptr cTableCTE rab_ret s)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isRight rab_ret\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> ?Q265 thread msgInfo cptr cTableCTE rab_ret s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 4. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (case rab_ret of Inl x \<Rightarrow> ((\<lambda>rv. if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)) \<circ> Inl) x | Inr rv \<Rightarrow> do rv <- liftE (do cte <- getCTE (fst rv);
return (cteCap cte)
od);
if isRight rv then if isEndpointCap (theRight rv) \<and> capEPCanReceive (theRight rv) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (theRight rv));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (theRight rv)) (capEPCanGrant (theRight rv)))) thread;
y <- setEndpoint (capEPPtr (theRight rv)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv) else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> ?Q265 thread msgInfo cptr cTableCTE rab_ret s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 4. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (8 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q265 thread msgInfo cptr cTableCTE rab_ret) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do cte <- getCTE (fst (theRight rab_ret));
if isEndpointCap (cteCap cte) \<and> capEPCanReceive (cteCap cte) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (cteCap cte));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte)))) thread;
y <- setEndpoint (capEPPtr (cteCap cte)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> ?Q265 thread msgInfo cptr cTableCTE rab_ret s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 4. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 5. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 6. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 7. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 8. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret cte. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q301 thread msgInfo cptr cTableCTE rab_ret cte) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isEndpointCap (cteCap cte) \<and> capEPCanReceive (cteCap cte) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (cteCap cte));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap cte)) (capEPCanGrant (cteCap cte)))) thread;
y <- setEndpoint (capEPPtr (cteCap cte)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>?Q301 thread msgInfo cptr cTableCTE rab_ret\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q301 thread msgInfo cptr cTableCTE rab_ret ep_cap) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) then do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>?Q301 thread msgInfo cptr cTableCTE rab_ret\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R329 thread msgInfo cptr cTableCTE rab_ret ep_cap) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q329 thread msgInfo cptr cTableCTE rab_ret ep_cap) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ?Q329 thread msgInfo cptr cTableCTE rab_ret ep_cap s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> ?R329 thread msgInfo cptr cTableCTE rab_ret ep_cap s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q329 thread msgInfo cptr cTableCTE rab_ret ep_cap) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do bound_ntfn <- getBoundNotification thread;
active_ntfn <- case bound_ntfn of None \<Rightarrow> return False | Some ntfnptr \<Rightarrow> liftM EndpointDecls_H.isActive (getNotification ntfnptr);
if \<not> active_ntfn then do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ?Q329 thread msgInfo cptr cTableCTE rab_ret ep_cap s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q334 thread msgInfo cptr cTableCTE rab_ret ep_cap rv) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if \<not> rv then do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ?Q334 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) s) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q334 thread msgInfo cptr cTableCTE rab_ret ep_cap ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if \<not> ep then do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ?Q334 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) s) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> \<not> ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R399 thread msgInfo cptr cTableCTE rab_ret ep_cap ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q399 thread msgInfo cptr cTableCTE rab_ret ep_cap ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> ?Q399 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> ?R399 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) s)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (9 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q399 thread msgInfo cptr cTableCTE rab_ret ep_cap ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do ep <- getEndpoint (capEPPtr (cteCap ep_cap));
if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> ?Q399 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 5. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 6. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 7. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 8. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 9. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if \<not> isSendEP epa then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case epa of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>?Q404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q404 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if \<not> isSendEP ep then do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>?Q404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> ?R432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (10 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep) (do cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
do y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od) (do callerCTE <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
if isReplyCap (cteCap callerCTE) \<and> \<not> capReplyMaster (cteCap callerCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap callerCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap callerCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap callerCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap callerCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap callerCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap callerCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap callerCTE));
y <- setCurThread (capTCBPtr (cteCap callerCTE));
y <- asUser (capTCBPtr (cteCap callerCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 6. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 7. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 8. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 9. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
 10. \<And>s. (invs' and ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s))) s \<Longrightarrow> (True \<longrightarrow> fastpathKernelAssertions s \<longrightarrow> ?P13 s) \<and> (\<not> True \<longrightarrow> ?P13 s \<and> fastpathKernelAssertions s) proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep cte. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q442 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep cte) (do y <- if isReplyCap (cteCap cte) then if capReplyMaster (cteCap cte) then fail else do y <- assert (capTCBPtr (cteCap cte) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap cte))
od else if cteCap cte = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isReplyCap (cteCap cte) \<and> \<not> capReplyMaster (cteCap cte) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap cte));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap cte));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap cte));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap cte));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap cte)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap cte));
y <- Arch.switchToThread (capTCBPtr (cteCap cte));
y <- setCurThread (capTCBPtr (cteCap cte));
y <- asUser (capTCBPtr (cteCap cte)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q442 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q442 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE) (do y <- if isReplyCap (cteCap replyCTE) then if capReplyMaster (cteCap replyCTE) then fail else do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))
od else if cteCap replyCTE = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) then do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q442 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; \<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE) (do y <- if isReplyCap (cteCap replyCTE) then if capReplyMaster (cteCap replyCTE) then fail else do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))
od else if cteCap replyCTE = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE) (do y <- if isReplyCap (cteCap replyCTE) then if capReplyMaster (cteCap replyCTE) then fail else do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))
od else if cteCap replyCTE = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> ?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> ?R445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 8. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE) (do y <- if isReplyCap (cteCap replyCTE) then if capReplyMaster (cteCap replyCTE) then fail else do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))
od else if cteCap replyCTE = capability.NullCap then return () else fail;
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> ?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE) (do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> ?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE) (do y <- assert (capTCBPtr (cteCap replyCTE) \<noteq> thread);
do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)
od) (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> ?Q445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P469 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerFault <- threadGet tcbFault (capTCBPtr (cteCap replyCTE));
if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> ?P469 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 7. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 8. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 9. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
 10. \<lbrace>?P13\<rbrace> getCurThread \<lbrace>\<lambda>thread. ?P64 thread and tcb_at' thread\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q473 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if callerFault = None then do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>?Q473 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 8. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault \<noteq> None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> ?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault s) \<and> (callerFault \<noteq> None \<longrightarrow> ?R512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 9. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do x <- getThreadVSpaceRoot (capTCBPtr (cteCap replyCTE));
newVTable <- getCTE x;
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (armKSASIDMap \<circ> ksArchState);
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (mdbPrev \<circ> cteMDBNode) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (mdbNext_update (\<lambda>y. 0) \<circ> mdbFirstBadged_update (\<lambda>y. True) \<circ> mdbRevocable_update (\<lambda>y. True));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> ?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 8. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do newVTable <- getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot);
if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> ?Q512 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 8. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 9. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
 10. \<And>thread. \<lbrace>?P64 thread\<rbrace> asUser thread (getRegister TCB_H.msgInfoRegister) \<lbrace>\<lambda>msgInfo. ?P94 thread msgInfo and tcb_at' thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault newVTable. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q527 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault newVTable) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isValidVTableRoot (cteCap newVTable) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap newVTable))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>?Q527 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 9. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q527 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if isValidVTableRoot (cteCap vTableCTE) then do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>?Q527 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 9. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; \<not> isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> ?Q566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> ?R566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 10. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do curDom <- curDomain;
callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> ?Q566 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 9. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
 10. \<And>thread msgInfo. \<lbrace>?P94 thread msgInfo\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>cptr. ?P124 thread msgInfo cptr and tcb_at' thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerPrio <- threadGet tcbPriority (capTCBPtr (cteCap replyCTE));
highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>?Q571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
 10. \<And>thread msgInfo cptr. \<lbrace>?P124 thread msgInfo cptr\<rbrace> threadGet tcbFault thread \<lbrace>\<lambda>tcbFault. (\<lambda>s. (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<longrightarrow> (?P191 thread msgInfo cptr tcbFault and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCTableSlot)) s) \<and> (\<not> (tcbFault = None \<and> msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters) \<longrightarrow> True)) and (\<lambda>_. True)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do highest <- isHighestPrio curDom callerPrio;
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>?Q599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q599 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do highest <- gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio);
if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>?Q599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P191 thread msgInfo cptr None\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE. ?P234 thread msgInfo cptr cTableCTE and (\<lambda>_. True) and ((\<lambda>s. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) slot s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s)) and (\<lambda>_. True))\<rbrace>
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q628 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if highest then do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>?Q628 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); \<not> highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> ?Q667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest s) \<and> (\<not> highest \<longrightarrow> ?R667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do asidMap <- gets (\<lambda>a. armKSASIDMap (ksArchState a));
if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> ?Q667 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE. msgExtraCaps (messageInfoFromWord msgInfo) = 0 \<and> msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters \<Longrightarrow> \<lbrace>?P234 thread msgInfo cptr cTableCTE\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>rab_ret s. (isRight rab_ret \<longrightarrow> (?P301 thread msgInfo cptr cTableCTE rab_ret and cte_wp_at' (\<lambda>_. True) (fst (theRight rab_ret))) s) \<and> (\<not> isRight rab_ret \<longrightarrow> True)\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v} then do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>?Q672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?Q700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?R700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do callerDom <- threadGet tcbDomain (capTCBPtr (cteCap replyCTE));
if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv)
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> ?Q700 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?P301 thread msgInfo cptr cTableCTE rab_ret\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap s. (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap) \<longrightarrow> ((\<lambda>s. ((\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> (?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap (\<exists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) and ep_at' (capEPPtr (cteCap ep_cap))) s) \<and> (\<not> (\<nexists>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<and> \<not> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. \<forall>tcb. ko_at' tcb thread s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s))) s) \<and> (\<not> (isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap)) \<longrightarrow> True)\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (if callerDom = curDom then do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od else callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>?Q705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom \<noteq> curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?R733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (callKernel (SyscallEvent SysReplyRecv))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ?Q733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom s) \<and> (callerDom \<noteq> curDom \<longrightarrow> ?R733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom s)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od \<sqinter> callKernel (SyscallEvent SysReplyRecv)) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ?Q733 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q737 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q737 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q737 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and ?Q737 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom v) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom v x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom v x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ?Q741 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom v x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P752 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do y <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
thread <- getCurThread;
epCPtr <- asUser thread (getRegister Thread_H.capRegister);
rv <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) epCPtr (size epCPtr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault thread \<circ> Fault_H.fault.CapFault epCPtr True;
y <- ThreadDecls_H.schedule;
y <- activateThread;
stateAssert kernelExitAssertions []
od) (?g742 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g742 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> (?P752 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v)) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R792 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> activateThread \<lbrace>\<lambda>xe _. True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> ThreadDecls_H.schedule \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?R792 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R782 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> do rv <- getCTE (xa + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) xb (size xb);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just xa \<or> boundTCB = Nothing then withoutFailure $ receiveSignal xa (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap xa;
receiveIPC xa (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault xa \<circ> Fault_H.fault.CapFault xb True \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?R787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R777 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> asUser xa (getRegister Thread_H.capRegister) \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?R782 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R772 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> getCurThread \<lbrace>\<lambda>xa. (\<lambda>_. True) and ?R777 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R764 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE)) \<lbrace>\<lambda>x. (\<lambda>_. True) and ?R772 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault x \<circ> Fault_H.fault.CapFault xa True;
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and ?R764 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v)) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do y <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
y <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
mdbPrev <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
y <- assert (mdbPrev \<noteq> 0);
y <- updateMDB mdbPrev (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
y <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
y <- setCurThread (capTCBPtr (cteCap replyCTE));
y <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> handleFault x \<circ> Fault_H.fault.CapFault xa True;
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?b743 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q748 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v)) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi xj. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1007 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi xj\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]) \<lbrace>\<lambda>xk _. True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R994 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi\<rbrace> setCurThread (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xj. (\<lambda>_. True) and ?R1007 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi xj\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R981 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh\<rbrace> doMachineOp ARM.clearExMonitor \<lbrace>\<lambda>xi. (\<lambda>_. True) and ?R994 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh xi\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R968 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg\<rbrace> setVMRoot (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xh. (\<lambda>_. True) and ?R981 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg xh\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R955 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf\<rbrace> setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xg. (\<lambda>_. True) and ?R968 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf xg\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R938 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>xf. (\<lambda>_. True) and ?R955 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R923 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<lbrace>\<lambda>xe. (\<lambda>_. True) and ?R938 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R908 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> updateMDB xb (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a))) \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?R923 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R893 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (xb \<noteq> 0) \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?R908 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R878 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot)) \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?R893 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
A total of 30 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P750 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1110 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1110 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1119 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE));
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1114 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1114 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1119 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1119 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))) (?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- ?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1119 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1135 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (doReplyTransfer thread (capTCBPtr (cteCap replyCTE)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (capReplyCanGrant (cteCap replyCTE))) (?g1130 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1130 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- ?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (?P1135 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do state <- getThreadState (capTCBPtr (cteCap replyCTE));
assert (isReply state);
cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
mdbnode <- return $ cteMDBNode cte;
assert (mdbPrev mdbnode \<noteq> 0 \<and> mdbNext mdbnode = 0);
parentCTE <- getCTE (mdbPrev mdbnode);
assert (isReplyCap (cteCap parentCTE) \<and> capReplyMaster (cteCap parentCTE));
doIPCTransfer thread Nothing 0 (capReplyCanGrant (cteCap replyCTE)) (capTCBPtr (cteCap replyCTE));
cteDeleteOne (thread + 2 ^ cte_level_bits * tcbCallerSlot);
setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
possibleSwitchTo (capTCBPtr (cteCap replyCTE))
od) (?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- ?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do state <- getThreadState (capTCBPtr (cteCap replyCTE));
y <- assert (isReply state);
cte <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- assert (mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0);
parentCTE <- getCTE (mdbPrev (cteMDBNode cte));
y <- assert (isReplyCap (cteCap parentCTE) \<and> capReplyMaster (cteCap parentCTE));
y <- doIPCTransfer thread None 0 (capReplyCanGrant (cteCap replyCTE)) (capTCBPtr (cteCap replyCTE));
y <- cteDeleteOne (thread + 2 ^ cte_level_bits * tcbCallerSlot);
y <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
possibleSwitchTo (capTCBPtr (cteCap replyCTE))
od) (?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- ?g1123 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ?Q1133 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- setMessageInfo (capTCBPtr (cteCap replyCTE)) (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do a <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g1105 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1549 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x) (do x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>?Q1549 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od >>= ?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1549 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked) (do x <- getCurThread;
xa <- asUser x (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (x + 2 ^ cte_level_bits * tcbCTableSlot);
doE xa <- CSpace_H.resolveAddressBits (cteCap rv) xa (size xa);
do rv <- getCTE (fst xa);
case cteCap rv of capability.NotificationCap ntfnPtr xa xaa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just x \<or> boundTCB = Nothing then withoutFailure $ receiveSignal x (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap xa xaa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap x;
receiveIPC x (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault x (Fault_H.fault.CapFault xa True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>?Q1549 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od >>= ?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked) (do x <- asUser thread (getRegister Thread_H.capRegister);
x <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) x (size x);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault thread (Fault_H.fault.CapFault x True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ?Q1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od >>= ?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked) (do x <- do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault thread (Fault_H.fault.CapFault cptr True a));
x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ?Q1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od >>= ?j1565 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
A total of 22 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked) (do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od <catch> (\<lambda>a. handleFault thread (Fault_H.fault.CapFault cptr True a))) (?g1628 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1628 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
?g1628 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked) (do rv <- getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot);
doE x <- CSpace_H.resolveAddressBits (cteCap rv) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE
od) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1646 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked rv) (doE x <- CSpace_H.resolveAddressBits (cteCap rv) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>?Q1646 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1674 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked cTableCTE2) (doE x <- CSpace_H.resolveAddressBits (cteCap cTableCTE2) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ?Q1674 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked cTableCTE2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1674 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer () cTableCTE2) (doE x <- CSpace_H.resolveAddressBits (cteCap cTableCTE) cptr (size cptr);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ?Q1674 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked cTableCTE2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1696 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (CSpace_H.resolveAddressBits (cteCap cTableCTE) cptr (size cptr)) (?g1686 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?R1694 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> ?g1686 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 \<lbrace>\<lambda>x _. True\<rbrace>, -
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (doE x <- ?g1686 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2;
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and (?P1696 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2 and ?R1694 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2 and ?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?R1694 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) \<lbrace>\<lambda>x _. True\<rbrace>, -
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (doE x <- gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and ?R1694 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2 and ?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (doE x <- gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ?Q1680 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1715 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (doE x <- gets (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of);
do rv <- getCTE (fst x);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od
odE) (?g1709 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (?g1709 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and (?P1715 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2 and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (lift (\<lambda>a. do rv <- getCTE (fst a);
case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od) rab_ret) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2) (do rv <- getCTE (fst (theRight rab_ret));
case cteCap rv of capability.NotificationCap ntfnPtr x xa True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | capability.NotificationCap ntfnPtr x xa False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb True xc xd \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | capability.EndpointCap x xa xb False xc xd \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0
od) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1734 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 rv) (case cteCap rv of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap rv) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap rv) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>?Q1734 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1734 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2) (case cteCap ep_cap2 of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap ep_cap2) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap ep_cap2) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>?Q1734 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1763 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2) (case cteCap ep_cap2 of capability.NotificationCap ntfnPtr x xa a \<Rightarrow> case a of True \<Rightarrow> doE ntfn <- withoutFailure $ getNotification ntfnPtr;
boundTCB <- returnOk $ ntfnBoundTCB ntfn;
if boundTCB = Just thread \<or> boundTCB = Nothing then withoutFailure $ receiveSignal thread (cteCap ep_cap2) True else throw $ Fault_H.lookup_failure.MissingCapability 0
odE | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | capability.EndpointCap x xa xb bool2 xc xd \<Rightarrow> case bool2 of True \<Rightarrow> withoutFailure $ do deleteCallerCap thread;
receiveIPC thread (cteCap ep_cap2) True
od | False \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0 | _ \<Rightarrow> throw $ Fault_H.lookup_failure.MissingCapability 0) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and ?Q1763 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1763 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer cTableCTE2 ep_cap2) (liftE (do y <- deleteCallerCap thread;
receiveIPC thread (cteCap ep_cap) True
od)) (?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and ?Q1763 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> ?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(?g1642 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1773 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (do y <- deleteCallerCap thread;
receiveIPC thread (cteCap ep_cap) True
od) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and ?Q1773 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1783 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (do y <- deleteCallerCap thread;
receiveIPC thread (cteCap ep_cap) True
od) (?g1777 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (?g1777 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (?P1783 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2 and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1792 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (deleteCallerCap thread) (?g1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x) (receiveIPC thread (cteCap ep_cap) True) (?j1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2\<rbrace> ?g1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 \<lbrace>?Q1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (?g1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 >>= ?j1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (?P1792 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2 and ?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2 and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x) (receiveIPC thread (cteCap ep_cap) True) (?j1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2 x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2\<rbrace> return () \<lbrace>?Q1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (return () >>= ?j1787 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2 and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> \<lbrace>?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2\<rbrace> return () \<lbrace>\<lambda>x. (\<lambda>_. isEndpointCap (cteCap ep_cap) \<and> \<not> isSendEP ep) and (ko_at' ep (capEPPtr (cteCap ep_cap)) and (\<lambda>s. \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<longrightarrow> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s))\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (do x <- return ();
setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ?R1790 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2 and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (do y <- setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. isEndpointCap (cteCap ep_cap) \<and> \<not> isSendEP ep) and (ko_at' ep (capEPPtr (cteCap ep_cap)) and (\<lambda>s. \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<longrightarrow> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s))) and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (?g1774 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) thread) (?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. isEndpointCap (cteCap ep_cap) \<and> \<not> isSendEP ep) and (ko_at' ep (capEPPtr (cteCap ep_cap)) and (\<lambda>s. \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<longrightarrow> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s))) and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- ?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (do a <- ?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2 ep_cap2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE; cteCap ep_cap2 = cteCap ep_cap\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer cTableCTE2 ep_cap2) (setThreadState (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) thread) (?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. isEndpointCap (cteCap ep_cap) \<and> \<not> isSendEP ep) and (ko_at' ep (capEPPtr (cteCap ep_cap)) and (\<lambda>s. \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<longrightarrow> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s))) and ?Q1781 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer cTableCTE2 ep_cap2)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- ?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (do a <- ?g1806 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer cTableCTE2. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom; cteCap cTableCTE2 = cteCap cTableCTE\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2. (\<lambda>_. cteCap ep_cap2 = cteCap ep_cap) and (cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. isEndpointCap (cteCap ep_cap) \<and> \<not> isSendEP ep) and (ko_at' ep (capEPPtr (cteCap ep_cap)) and (\<lambda>s. \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread s \<longrightarrow> obj_at' (Not \<circ> EndpointDecls_H.isActive) ntfnptr s))) and (\<lambda>a. (runnable' (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) \<or> ksSchedulerAction a \<noteq> ResumeCurrentThread \<or> thread \<noteq> ksCurThread a) \<and> obj_at' (\<lambda>x. highest) thread a))\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer cTableCTE2 v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; cteCap cTableCTE2 = cteCap cTableCTE; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () cTableCTE2\<rbrace> getCTE (fst (theRight rab_ret)) \<lbrace>\<lambda>ep_cap2 a. cteCap ep_cap2 = cteCap ep_cap \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCTableSlot) \<lbrace>\<lambda>cTableCTE2. (\<lambda>_. cteCap cTableCTE2 = cteCap cTableCTE) and ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and ?Q1713 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked cTableCTE2))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1633 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) (do x <- ThreadDecls_H.schedule;
x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>?Q1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
(liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x))) >>= ?j1626 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x) ThreadDecls_H.schedule (?g1843 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa) (do x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x xa)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> ?g1843 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x \<lbrace>?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. ?P1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
xa <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
?g1843 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa >>= ?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa) (do x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer unblocked x xa)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
xa <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od >>= ?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer () () ()) (do x <- activateThread;
stateAssert kernelExitAssertions []
od) (?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>?Q1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
xa <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od >>= ?j1841 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?P1862 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ()) activateThread (?g1858 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ())
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q1851 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x) (stateAssert kernelExitAssertions []) (?j1856 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () () x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ()\<rbrace> ?g1858 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () () \<lbrace>?Q1851 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>\<lambda>a. ?P1862 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked x a and ?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked x a\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
xa <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
xb <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
?g1858 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb >>= ?j1856 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True True (?Q1851 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x) (stateAssert kernelExitAssertions []) (?j1856 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () () x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ()\<rbrace> return () \<lbrace>?Q1851 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>\<lambda>a. ct_in_state' ((=) Structures_H.thread_state.Running) and ?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked x a\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
xa <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
xb <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
return xb >>= ?j1856 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer () () ()\<rbrace> return () \<lbrace>\<lambda>x _. True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>\<lambda>a. ct_in_state' ((=) Structures_H.thread_state.Running) and ?R1860 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer unblocked x a\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od \<lbrace>\<lambda>a. ct_in_state' ((=) Structures_H.thread_state.Running) and (\<lambda>a. True)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B1872 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x xa\<rbrace> setCurThread (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xb s. ct_in_state' ((=) Structures_H.thread_state.Running) (s\<lparr>ksSchedulerAction := ResumeCurrentThread\<rparr>) \<and> True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> Arch.switchToThread (capTCBPtr (cteCap replyCTE)) \<lbrace>?B1872 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B1872 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer () () ()\<rbrace> setCurThread (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xb. ct_in_state' ((=) Structures_H.thread_state.Running)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace> Arch.switchToThread (capTCBPtr (cteCap replyCTE)) \<lbrace>?B1872 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and ?R1838 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked x\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>x. (\<lambda>s. ksSchedulerAction s = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> st_tcb_at' (Not \<circ> runnable') thread s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s) and st_tcb_at' ((=) Structures_H.thread_state.Running) (capTCBPtr (cteCap replyCTE))\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True asidMap curDom ipcBuffer ()\<rbrace> do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od \<lbrace>\<lambda>x a. ksSchedulerAction a = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (Not \<circ> tcbQueued) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> st_tcb_at' (Not \<circ> runnable') thread a \<and> ksCurThread a \<noteq> ksIdleThread a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (capTCBPtr (cteCap replyCTE)) a\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> asUser thread (getRegister Thread_H.capRegister) \<lbrace>\<lambda>rv' _. rv' = cptr\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked\<rbrace> getCurThread \<lbrace>\<lambda>rv' _. rv' = thread\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. ?P1570 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and (?P1595 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and ?R1620 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer unblocked))\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
A total of 22 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked. (\<lambda>s. ksCurThread s = thread) and (obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb Thread_H.capRegister = cptr) thread and ((\<lambda>s. cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> ((\<lambda>a. (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (ksCurThread a + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a)) and (\<lambda>a. True) and ((\<lambda>a. (resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) \<circ> only_cnode_caps \<circ> ctes_of) a = rab_ret) and (\<lambda>a. cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> (ksSchedulerAction a = ResumeCurrentThread \<longrightarrow> thread \<noteq> ksCurThread a) \<and> tcb_at' thread a))) s) and (\<lambda>_. True) and (\<lambda>a. ksSchedulerAction a = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> obj_at' (\<lambda>obj. if thread = capTCBPtr (cteCap replyCTE) then True else True) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>obj. if thread = capTCBPtr (cteCap replyCTE) then (Not \<circ> tcbQueued) (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) obj) else (Not \<circ> tcbQueued) obj) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> (tcb_at' thread a \<longrightarrow> (thread = thread \<longrightarrow> obj_at' (\<lambda>tcb. (Not \<circ> runnable') (itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) tcb)))) thread a) \<and> (thread \<noteq> thread \<longrightarrow> st_tcb_at' (Not \<circ> runnable') thread a)) \<and> ksCurThread a \<noteq> ksIdleThread a \<and> obj_at' (\<lambda>obj. if thread = capTCBPtr (cteCap replyCTE) then True else True) (capTCBPtr (cteCap replyCTE)) a \<and> (tcb_at' (capTCBPtr (cteCap replyCTE)) and fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE))) a \<and> (tcb_at' thread a \<longrightarrow> (capTCBPtr (cteCap replyCTE) = thread \<longrightarrow> obj_at' (\<lambda>tcb. Structures_H.thread_state.Running = itcbState (tcb_to_itcb' (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) tcb))) thread a) \<and> (capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Running) (capTCBPtr (cteCap replyCTE)) a)))))\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od \<lbrace>\<lambda>unblocked a. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread a \<and> cte_wp_at' (\<lambda>c. cteCap c = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a \<and> (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> cte_wp_at' (\<lambda>c. cteCap c = cteCap ep_cap) (fst (theRight rab_ret)) a \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr a) \<and> tcb_at' thread a \<and> ksSchedulerAction a = SwitchToThread (capTCBPtr (cteCap replyCTE)) \<and> obj_at' (\<lambda>obj. \<not> tcbQueued obj) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> ksCurThread a \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a \<and> (tcb_at' thread a \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Running) (capTCBPtr (cteCap replyCTE)) a)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb xd v prev_s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P2253 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd prev_s\<rbrace> emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap \<lbrace>\<lambda>rv s'. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread s' \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s' \<and> (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s') \<and> valid_objs' s' \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s')) (gsCNodes prev_s) \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s')) = rab_ret \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) s' \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s' \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s' \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread prev_s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s') \<and> tcb_at' thread prev_s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s' \<and> ksCurThread prev_s = thread \<and> ksCurThread prev_s \<noteq> ksIdleThread prev_s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) prev_s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s' \<and> (tcb_at' thread prev_s \<longrightarrow> tcb_at' (capTCBPtr (cteCap replyCTE)) prev_s)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od \<lbrace>?B2254 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb xc xd xe\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> assert (isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd)) \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd. ?B2254 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer x () xb () xd () () \<equiv>\<^sup>? \<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s. ?P2253 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s s proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb xd v prev_s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P2253 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd prev_s\<rbrace> emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap \<lbrace>\<lambda>r s. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread s \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s \<and> (isCNodeCap (cteCap cTableCTE) \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes prev_s) \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s)) = rab_ret \<and> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread prev_s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s) \<and> tcb_at' thread prev_s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread prev_s = thread \<and> ksCurThread prev_s \<noteq> ksIdleThread prev_s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) prev_s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) prev_s\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od \<lbrace>?B2254 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb xc xd xe\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> assert (isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd)) \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd. ?B2254 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer x () xb () xd () () \<equiv>\<^sup>? \<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s. ?P2253 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s s proof (prove)
goal (27 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb xd v prev_s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P'2602 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd prev_s\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) prev_s \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2464 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))) \<lbrace>\<lambda>xg s. (K (capTCBPtr (cteCap replyCTE) \<noteq> thread) and obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread) s \<and> (thread + 2 ^ cte_level_bits * tcbCTableSlot = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (thread + 2 ^ cte_level_bits * tcbCTableSlot \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (thread + 2 ^ cte_level_bits * tcbCTableSlot = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (thread + 2 ^ cte_level_bits * tcbCTableSlot \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s) \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s)) = rab_ret \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap ep_cap) (fst (theRight rab_ret)) s) \<and> (thread + 2 ^ cte_level_bits * tcbCallerSlot = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = capability.NullCap) \<and> (thread + 2 ^ cte_level_bits * tcbCallerSlot \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s \<and> (\<forall>x. \<not> bound_tcb_at' ((=) (Some x)) thread s \<or> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s) \<and> tcb_at' thread s \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>tcb. highest) (capTCBPtr (cteCap replyCTE)) s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>x. highest) (capTCBPtr (cteCap replyCTE)) s \<and> ?P'2600 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb xc xd xe xf xg s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>?B2464 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> assert (isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd)) \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
A total of 27 subgoals...
flex-flex pairs:
\<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s. ?P'2602 thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd s s \<equiv>\<^sup>? \<lambda>thread msgInfo cptr cTableCTE rab_ret ep_cap ep replyCTE vTableCTE curDom callerPrio asidMap ipcBuffer x xb xd. ?P'2600 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer x () xb () xd () () () proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb xd v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P'2652 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) asidMap curDom ipcBuffer x () xb () xd () ()\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))) \<lbrace>\<lambda>rv s. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread s \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> (isCNodeCap (cteCap cTableCTE) \<longrightarrow> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s)) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s) \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s)) = rab_ret \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap ep_cap) (fst (theRight rab_ret)) s) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s) \<and> tcb_at' thread s \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>xf s. K (capTCBPtr (cteCap replyCTE) \<noteq> thread) s \<and> ?P'2652 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> assert (isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd)) \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb xd v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P'2652 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) asidMap curDom ipcBuffer x () xb () xd () ()\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))) \<lbrace>\<lambda>rv s. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = cptr) thread s \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s) \<and> cte_wp_at' (\<lambda>cte. \<not> isCNodeCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = cteCap ep_cap) (fst (theRight rab_ret)) s) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s) \<and> tcb_at' thread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) s\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>xf s. K (capTCBPtr (cteCap replyCTE) \<noteq> thread) s \<and> ?P'2652 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd xe xf s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace> assert (isReplyCap (cteCap xd) \<and> capReplyMaster (cteCap xd)) \<lbrace>?B2055 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc xd\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>?B2054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>?B2053 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3032 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer x () xb ()\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>\<lambda>rv s. \<not> isReplyCap (cteCap rv)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer x xb v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3030 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer x () xb ()\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>\<lambda>rv s. \<not> capReplyMaster (cteCap rv)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q'3017 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc\<rbrace> getCTE (mdbPrev (cteMDBNode xb)) \<lbrace>\<lambda>rv s. (K (capTCBPtr (cteCap replyCTE) \<noteq> thread) and obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread) s \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of s)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) s) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) s \<and> (\<forall>x. \<not> bound_tcb_at' ((=) (Some x)) thread s \<or> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x s) \<and> tcb_at' thread s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) s \<and> ksCurThread s = thread \<and> thread \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) s \<and> (tcb_at' (capTCBPtr (cteCap replyCTE)) and fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE))) s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb\<rbrace> assert (mdbPrev (cteMDBNode xb) \<noteq> 0 \<and> mdbNext (cteMDBNode xb) = 0) \<lbrace>\<lambda>xc s. K (capTCBPtr (cteCap replyCTE) \<noteq> thread) s \<and> ((?P'3032 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb xc s \<or> ?Q'3030 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap ipcBuffer x xa xb xc s) \<or> ?Q'3017 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa xb xc s)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?B2052 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x xa\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace> assert (isReply x) \<lbrace>?B2051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer x\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> \<lbrace>?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap (ds_id False) ep replyCTE (ds_id None) vTableCTE curDom callerPrio (ds_id True) curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?B2045 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap callerDom ipcBuffer. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; callerDom = curDom\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr highest x));
x <- do Arch.switchToThread (capTCBPtr (cteCap replyCTE));
setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
x <- return x;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and ?Q1117 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- do rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0)
od;
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)))
od;
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x));
x <- do a <- Arch.switchToThread (capTCBPtr (cteCap replyCTE));
a <- setCurThread (capTCBPtr (cteCap replyCTE));
setSchedulerAction ResumeCurrentThread
od;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ?Q1108 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3111 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
rv <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
y <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x));
y <- setVMRoot (capTCBPtr (cteCap replyCTE));
y <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (?g3101 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q3107 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b3102 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (?g3101 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v) (?b3102 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and (?P3111 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q3107 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn xo. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3206 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn xo\<rbrace> setSchedulerAction ResumeCurrentThread \<lbrace>\<lambda>xp _. True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3201 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn\<rbrace> setCurThread (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xo. (\<lambda>_. True) and ?R3206 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn xo\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3196 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm\<rbrace> doMachineOp ARM.clearExMonitor \<lbrace>\<lambda>xn. (\<lambda>_. True) and ?R3201 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm xn\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3191 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl\<rbrace> setVMRoot (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xm. (\<lambda>_. True) and ?R3196 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl xm\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3186 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk\<rbrace> liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x)) \<lbrace>\<lambda>xl. (\<lambda>_. True) and ?R3191 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk xl\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3181 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj\<rbrace> setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE))) \<lbrace>\<lambda>xk. (\<lambda>_. True) and ?R3186 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj xk\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3176 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi\<rbrace> setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xj. (\<lambda>_. True) and ?R3181 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3171 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh\<rbrace> emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap \<lbrace>\<lambda>xi. (\<lambda>_. True) and ?R3176 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3166 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>xh. (\<lambda>_. True) and ?R3171 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3161 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))) \<lbrace>\<lambda>xg. (\<lambda>_. True) and ?R3166 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg\<rbrace>
A total of 36 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q3107 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b3102 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (?b3102 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ?Q3107 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3484 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj\<rbrace> asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]) \<lbrace>\<lambda>xk _. True\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3471 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi\<rbrace> setCurThread (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xj. (\<lambda>_. True) and ?R3484 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi xj\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3458 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh\<rbrace> doMachineOp ARM.clearExMonitor \<lbrace>\<lambda>xi. (\<lambda>_. True) and ?R3471 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh xi\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg\<rbrace> setVMRoot (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xh. (\<lambda>_. True) and ?R3458 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg xh\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf\<rbrace> setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>xg. (\<lambda>_. True) and ?R3445 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf xg\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3415 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe\<rbrace> mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) \<lbrace>\<lambda>xf. (\<lambda>_. True) and ?R3432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe xf\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3400 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd\<rbrace> setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject \<lbrace>\<lambda>xe. (\<lambda>_. True) and ?R3415 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd xe\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3385 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc\<rbrace> updateMDB xb (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a))) \<lbrace>\<lambda>xd. (\<lambda>_. True) and ?R3400 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc xd\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3370 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb\<rbrace> assert (xb \<noteq> 0) \<lbrace>\<lambda>xc. (\<lambda>_. True) and ?R3385 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb xc\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?R3355 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa\<rbrace> liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot)) \<lbrace>\<lambda>xb. (\<lambda>_. True) and ?R3370 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x xa xb\<rbrace>
A total of 30 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- liftE (do a <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))
od) <catch> (\<lambda>x. handleFault thread (Fault_H.fault.CapFault cptr True x));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- liftM (\<lambda>a. mdbPrev (cteMDBNode a)) (getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot));
xa <- assert (x \<noteq> 0);
x <- updateMDB x (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- setThreadState Structures_H.thread_state.Running (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer) (do x <- getThreadState (capTCBPtr (cteCap replyCTE));
x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q3583 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- assert (isReply x);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>?Q3583 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3611 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ?P3611 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q3613 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ?Q3613 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (?g3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (?g3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (?b3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and (?P3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and ?Q3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?P3614 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x) (do x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0 \<and> mdbNext (cteMDBNode x) = 0);
x <- getCTE (mdbPrev (cteMDBNode x));
x <- assert (isReplyCap (cteCap x) \<and> capReplyMaster (cteCap x));
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister TCB_H.msgInfoRegister (wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))));
x <- asUser (capTCBPtr (cteCap replyCTE)) (setRegister Notification_H.badgeRegister 0);
x <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction (SwitchToThread (capTCBPtr (cteCap replyCTE)));
x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- setSchedulerAction ResumeCurrentThread;
stateAssert kernelExitAssertions []
od) (?g3614 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite False True (?Q3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do x <- threadSet (tcbState_update (\<lambda>_. Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap)))) thread;
x <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
x <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xa <- assert (mdbPrev (cteMDBNode x) \<noteq> 0);
x <- updateMDB (mdbPrev (cteMDBNode x)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
x <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
x <- mapM_x (\<lambda>r. do v <- asUser thread (getRegister r);
asUser (capTCBPtr (cteCap replyCTE)) (setRegister r v)
od) (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters);
x <- threadSet (tcbState_update (\<lambda>x. Structures_H.thread_state.Running)) (capTCBPtr (cteCap replyCTE));
x <- setVMRoot (capTCBPtr (cteCap replyCTE));
x <- doMachineOp ARM.clearExMonitor;
x <- setCurThread (capTCBPtr (cteCap replyCTE));
x <- asUser (capTCBPtr (cteCap replyCTE)) (zipWithM_x setRegister [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))]);
stateAssert kernelExitAssertions []
od) (?b3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (?g3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (?b3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and (?P3614 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and ?Q3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) (do a <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
aa <- assert (mdbPrev (cteMDBNode a) \<noteq> 0 \<and> mdbNext (cteMDBNode a) = 0);
a <- getCTE (mdbPrev (cteMDBNode a));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- return ();
a <- return ();
a <- return ();
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- return ();
a <- return ();
a <- return ();
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
a <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(highest := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a highest)))) \<circ> id \<circ> (\<lambda>a. a(epa := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a epa)))) \<circ> id \<circ> (\<lambda>a. a(epa := TCBStateRegs (tsrState (a epa)) ((tsrContext (a epa))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(epa := TCBStateRegs (tsrState (a epa)) ((tsrContext (a epa))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs highest epa r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id)) (isolate_thread_actions (case_bool thread (capTCBPtr (cteCap replyCTE))) (do xa <- return ();
xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xg <- return ();
xh <- return ();
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
xl <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) (do a <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
aa <- assert (mdbPrev (cteMDBNode a) \<noteq> 0 \<and> mdbNext (cteMDBNode a) = 0);
a <- getCTE (mdbPrev (cteMDBNode a));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- return ();
a <- return ();
a <- return ();
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- return ();
a <- return ();
a <- return ();
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
a <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id)) (isolate_thread_actions (case_bool thread (capTCBPtr (cteCap replyCTE))) (do xa <- return ();
xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xg <- return ();
xh <- return ();
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
xl <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and (?P3615 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite (True \<and> True) (False \<or> False) ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb')) (isolate_thread_actions (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) (do a <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
aa <- assert (mdbPrev (cteMDBNode a) \<noteq> 0 \<and> mdbNext (cteMDBNode a) = 0);
a <- getCTE (mdbPrev (cteMDBNode a));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- return ();
a <- return ();
a <- return ();
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- return ();
a <- return ();
a <- return ();
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
a <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id)) (isolate_thread_actions (case_bool thread (capTCBPtr (cteCap replyCTE))) (do xa <- return ();
xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xg <- return ();
xh <- return ();
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
xl <- return ();
stateAssert kernelExitAssertions []
od) (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite (True \<and> True) (False \<or> False) (?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x) (do a <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
aa <- assert (mdbPrev (cteMDBNode a) \<noteq> 0 \<and> mdbNext (cteMDBNode a) = 0);
a <- getCTE (mdbPrev (cteMDBNode a));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- return ();
a <- return ();
a <- return ();
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- return ();
a <- return ();
a <- return ();
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
a <- return ();
stateAssert kernelExitAssertions []
od) (do xa <- return ();
xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xg <- return ();
xh <- return ();
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
xl <- return ();
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x) (do a <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
aa <- assert (mdbPrev (cteMDBNode a) \<noteq> 0 \<and> mdbNext (cteMDBNode a) = 0);
a <- getCTE (mdbPrev (cteMDBNode a));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6026 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x rv) (do a <- assert (mdbPrev (cteMDBNode rv) \<noteq> 0 \<and> mdbNext (cteMDBNode rv) = 0);
a <- getCTE (mdbPrev (cteMDBNode rv));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q6026 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6026 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE) (do a <- assert (mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0);
a <- getCTE (mdbPrev (cteMDBNode callerCTE));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>?Q6026 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE) (do a <- getCTE (mdbPrev (cteMDBNode callerCTE));
a <- assert (isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a));
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) (do a <- assert (isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv));
a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>?Q6054 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P6078 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) (do a <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ?P6078 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P6078 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv) (do y <- setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]));
y <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xb <- setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]);
xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ?P6078 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
A total of 24 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?P6085 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv) (setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread]))) (setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y) (do y <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> (?P6085 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> setEndpoint (capEPPtr (cteCap ep_cap)) (Structures_H.endpoint.RecvEP (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> q @ [thread] | _ \<Rightarrow> [thread])) = setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread])
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y) (do y <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y) (do y <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xc <- getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot);
xd <- assert (mdbPrev (cteMDBNode xc) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode xc)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>?Q6080 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y) (do y <- emptySlot (thread + 2 ^ cte_level_bits * tcbCallerSlot) capability.NullCap;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xd <- assert (mdbPrev (cteMDBNode callerCTE) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode callerCTE)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. rv' = callerCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>\<lambda>y. ?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ?Q6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6128 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y) (do y <- do updateMDB (mdbPrev (cteMDBNode callerCTE)) (mdbNext_update (K 0) \<circ> mdbFirstBadged_update (K True) \<circ> mdbRevocable_update (K True));
setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject
od;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xd <- assert (mdbPrev (cteMDBNode callerCTE) \<noteq> 0);
xe <- updateMDB (mdbPrev (cteMDBNode callerCTE)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. rv' = callerCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>\<lambda>y. ?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. mdbNext (cteMDBNode callerCTE) = 0 \<and> mdbPrev (cteMDBNode callerCTE) \<noteq> 0) and ((\<lambda>_. cteCap callerCTE \<noteq> capability.NullCap) and (cte_wp_at' ((=) callerCTE) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode callerCTE)) and (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. no_0 (ctes_of s)))) and ?Q6128 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> monadic_rewrite True False (?Q6128 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv ()) (do y <- updateMDB (mdbPrev (cteMDBNode callerCTE)) (\<lambda>x. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) x)));
y <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
a <- setVMRoot (capTCBPtr (cteCap replyCTE));
a <- doMachineOp ARM.clearExMonitor;
a <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od) (do xe <- updateMDB (mdbPrev (cteMDBNode callerCTE)) (\<lambda>a. mdbNext_update (\<lambda>y. 0) (mdbFirstBadged_update (\<lambda>y. True) (mdbRevocable_update (\<lambda>y. True) a)));
xf <- setCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) makeObject;
xi <- setVMRoot (capTCBPtr (cteCap replyCTE));
xj <- doMachineOp ARM.clearExMonitor;
xk <- setCurThread (capTCBPtr (cteCap replyCTE));
stateAssert kernelExitAssertions []
od)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. rv' = callerCTE\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>\<lambda>y. ?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. mdbNext (cteMDBNode callerCTE) = 0 \<and> mdbPrev (cteMDBNode callerCTE) \<noteq> 0) and ((\<lambda>_. cteCap callerCTE \<noteq> capability.NullCap) and (cte_wp_at' ((=) callerCTE) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode callerCTE)) and (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. no_0 (ctes_of s)))) and ?Q6128 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. rv' = callerCTE\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>\<lambda>y. ?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. mdbNext (cteMDBNode callerCTE) = 0 \<and> mdbPrev (cteMDBNode callerCTE) \<noteq> 0) and ((\<lambda>_. cteCap callerCTE \<noteq> capability.NullCap) and (cte_wp_at' ((=) callerCTE) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode callerCTE)) and (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. no_0 (ctes_of s)))) and (\<lambda>a. highest))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv ()\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>rv' s. rv' = callerCTE\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0; isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)\<rbrakk> \<Longrightarrow> \<lbrace>?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x callerCTE rv\<rbrace> setEndpoint (capEPPtr (cteCap ep_cap)) (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]) \<lbrace>\<lambda>y. ?P6104 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv y and cte_wp_at' (\<lambda>_. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and ((\<lambda>_. mdbNext (cteMDBNode callerCTE) = 0 \<and> mdbPrev (cteMDBNode callerCTE) \<noteq> 0) and ((\<lambda>_. cteCap callerCTE \<noteq> capability.NullCap) and (cte_wp_at' ((=) callerCTE) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte)) (mdbPrev (cteMDBNode callerCTE)) and (\<lambda>s. reply_masters_rvk_fb (ctes_of s)) and (\<lambda>s. no_0 (ctes_of s)))) and (\<lambda>a. highest))\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE\<rbrace> getCTE (mdbPrev (cteMDBNode callerCTE)) \<lbrace>\<lambda>rv s. isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv) \<longrightarrow> ((\<lambda>a. highest) and ?R6083 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE rv) s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE)))\<rbrakk> \<Longrightarrow> \<lbrace>?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE vTableCTE curDom callerPrio True asidMap ipcBuffer v x\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>callerCTE s. mdbPrev (cteMDBNode callerCTE) \<noteq> 0 \<and> mdbNext (cteMDBNode callerCTE) = 0 \<longrightarrow> ?P6051 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x callerCTE s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s; tsrs = get_tcb_state_regs \<circ> ksPSpace s \<circ> (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE))\<rbrakk> \<Longrightarrow> (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. a(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (a True)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (a False)))) \<circ> id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(Notification_H.badgeRegister := 0)))) \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) ((tsrContext (a False))(TCB_H.msgInfoRegister := wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)))))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id) tsrs = (id \<circ> (\<lambda>a. a(False := TCBStateRegs (tsrState (a False)) (foldl (\<lambda>con (r, v). con(r := v)) (tsrContext (a False)) (zip [Notification_H.badgeRegister, TCB_H.msgInfoRegister] [0, wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo))])))) \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(False := TCBStateRegs Structures_H.thread_state.Running (tsrContext (tsrs False)))) \<circ> foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>tsrs. tsrs(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (tsrs True))))) tsrs
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> ?Q6020 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
A total of 25 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; tcb_at' thread s\<rbrakk> \<Longrightarrow> (\<lambda>a. if a then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. get_tcb_state_regs (ksPSpace s (case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)))) True)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) (\<lambda>a. get_tcb_state_regs (ksPSpace s (case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)))) False) a)) = (\<lambda>a. if \<not> a then TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else tsrContext (foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) ((get_tcb_state_regs \<circ> ksPSpace s \<circ> case_bool thread (capTCBPtr (cteCap replyCTE)))(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) False) a) else foldr (\<lambda>r. copy_register_tsrs True False r r (\<lambda>x. x)) (rev (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters)) ((get_tcb_state_regs \<circ> ksPSpace s \<circ> case_bool thread (capTCBPtr (cteCap replyCTE)))(True := TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))))) a)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; tcb_at' thread s\<rbrakk> \<Longrightarrow> (\<lambda>a. if a then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (\<lambda>a. if \<not> a then TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a) else if a then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE))))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; tcb_at' thread s\<rbrakk> \<Longrightarrow> (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s\<rbrakk> \<Longrightarrow> (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) ((atcbContextGet \<circ> tcbArch) ko)\<rbrakk> \<Longrightarrow> (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (tsrContext (get_tcb_state_regs (ksPSpace s thread))) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then tsrContext (get_tcb_state_regs (ksPSpace s thread)) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko))\<rbrakk> \<Longrightarrow> (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) TCB_H.msgRegisters) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko))\<rbrakk> \<Longrightarrow> (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)) = (if xa then TCBStateRegs (Structures_H.thread_state.BlockedOnReceive (capEPPtr (cteCap ep_cap)) (capEPCanGrant (cteCap ep_cap))) (atcbContextGet (tcbArch ko)) else TCBStateRegs Structures_H.thread_state.Running (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko)); \<not> xa\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = Notification_H.badgeRegister then 0 else if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a) = (\<lambda>a. if a = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if a = Notification_H.badgeRegister then 0 else if a \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) a else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) a)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s xa ko xb. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ksSchedulerAction s = ResumeCurrentThread; ko_at' ko thread s; get_tcb_state_regs (ksPSpace s thread) = TCBStateRegs (tcbState ko) (atcbContextGet (tcbArch ko)); \<not> xa\<rbrakk> \<Longrightarrow> (if xb = Notification_H.badgeRegister then 0 else if xb = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if xb \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) xb else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) xb) = (if xb = TCB_H.msgInfoRegister then wordFromMessageInfo (msgCapsUnwrapped_update (\<lambda>_. 0) (messageInfoFromWord msgInfo)) else if xb = Notification_H.badgeRegister then 0 else if xb \<in> set (take (unat (msgLength (messageInfoFromWord msgInfo))) [R2, R3, R4, R5]) then atcbContextGet (tcbArch ko) xb else tsrContext (get_tcb_state_regs (ksPSpace s (capTCBPtr (cteCap replyCTE)))) xb)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and tcb_at' thread) s\<rbrakk> \<Longrightarrow> (id \<circ> (\<lambda>a. ResumeCurrentThread) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> (\<lambda>a. SwitchToThread (capTCBPtr (cteCap replyCTE))) \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s) = (id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id \<circ> id) (ksSchedulerAction s)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v x s tsrs sa. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE); isReply x; inj (case_bool thread (capTCBPtr (cteCap replyCTE))); (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') s\<rbrakk> \<Longrightarrow> \<forall>cte. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some cte \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (mdbPrev (cteMDBNode cte)) = Some ctea \<longrightarrow> isReplyCap (cteCap ctea) \<and> capReplyMaster (cteCap ctea) \<longrightarrow> (\<forall>ctea. ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea \<longrightarrow> ctea = cte) \<and> cte_wp_at' (\<lambda>a. True) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cteCap cte \<noteq> capability.NullCap \<and> cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> cte_wp_at' (\<lambda>a. isReplyCap (cteCap a) \<and> capReplyMaster (cteCap a)) (mdbPrev (cteMDBNode cte)) (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>) \<and> reply_masters_rvk_fb (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)) \<and> no_0 (ctes_of (ksPSpace_update (partial_overwrite (\<lambda>a. case a of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) tsrs) s\<lparr>ksSchedulerAction := sa\<rparr>)))
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread msgInfo rab_ret ep_cap epa ep replyCTE vTableCTE highest asidMap v x s v0 v0a v1 v1a v2 v2a v3 v4 v5 ctea v0b v1b v2b cteb v0c v1c v2c. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; v0a \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; v3; \<not> v1a; isReply x; inj (case_bool thread v0a); cteCap replyCTE = capability.ReplyCap v0a False v2a; cteCap ep_cap = capability.EndpointCap v0 v1 v2 True v4 v5; \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s; valid_mdb' s; cteCap ctea = capability.ReplyCap v0b v1b v2b; ctes_of s (thread + 2 ^ cte_level_bits * tcbCallerSlot) = Some ctea; mdbPrev (cteMDBNode ctea) \<noteq> 0; mdbNext (cteMDBNode ctea) = 0; ctes_of s (mdbPrev (cteMDBNode ctea)) = Some cteb; v1c; cteCap cteb = capability.ReplyCap v0c True v2c\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb (ctes_of s) \<and> no_0 (ctes_of s)
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> ((\<lambda>_. inj (case_bool thread (capTCBPtr (cteCap replyCTE)))) and ((\<lambda>a. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) a) and ((\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and obj_at' (\<lambda>x. highest) thread and (cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) and (\<lambda>s. \<forall>x. obj_at' (\<lambda>x. highest) (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) and valid_mdb') and (\<lambda>s. \<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)))) s\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE vTableCTE curDom callerPrio highest asidMap ipcBuffer v. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; \<not> epa; \<not> isSendEP ep; capTCBPtr (cteCap replyCTE) \<noteq> thread; isValidVTableRoot (cteCap vTableCTE); highest; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}; isEndpointCap (cteCap ep_cap); capEPCanReceive (cteCap ep_cap); isReplyCap (cteCap replyCTE); \<not> capReplyMaster (cteCap replyCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio True curDom asidMap ipcBuffer\<rbrace> getThreadState (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>x s. isReply x \<longrightarrow> inj (case_bool thread (capTCBPtr (cteCap replyCTE))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) \<and> ksSchedulerAction s = ResumeCurrentThread \<and> tcb_at' thread s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> thread | False \<Rightarrow> capTCBPtr (cteCap replyCTE)) s)\<rbrace>
 2. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}\<rbrakk> \<Longrightarrow> \<lbrace>?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap\<rbrace> threadGet tcbDomain (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerDom s. (callerDom = curDom \<longrightarrow> ((\<lambda>_. True) and (\<lambda>x. (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x) \<and> (\<forall>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap replyCTE)) x \<longrightarrow> ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True) and (obj_at' (\<lambda>tcb. tcbFault tcb = callerFault) (capTCBPtr (cteCap replyCTE)) and ((\<lambda>a. highest) and (\<lambda>a. msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = msgInfo) thread a \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> obj_at' (\<lambda>a. tcbPriority a = callerPrio) (capTCBPtr (cteCap replyCTE)) a \<and> obj_at' (\<lambda>a. tcbDomain a = callerDom) (capTCBPtr (cteCap replyCTE)) a \<and> ksSchedulerAction a = ResumeCurrentThread \<and> ksCurThread a = thread \<and> ksCurDomain a = callerDom)) and (\<lambda>a. st_tcb_at' isReply (capTCBPtr (cteCap replyCTE)) a \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<longrightarrow> mdbPrev (cteMDBNode cte) \<noteq> 0 \<and> mdbNext (cteMDBNode cte) = 0 \<longrightarrow> (\<exists>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> isReplyCap (cteCap ctea)) \<or> (\<forall>ctea. cte_wp_at' ((=) ctea) (mdbPrev (cteMDBNode cte)) a \<longrightarrow> \<not> capReplyMaster (cteCap ctea)) \<or> obj_at' (\<lambda>a. atcbContextGet (tcbArch a) Thread_H.capRegister = cptr) thread a \<and> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cTableCTE) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cTableCTE) (thread + 2 ^ cte_level_bits * tcbCTableSlot) a) \<and> valid_objs' a \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of a)) (gsCNodes a) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (thread + 2 ^ cte_level_bits * tcbCallerSlot) a \<and> resolveAddressBitsFn (cteCap cTableCTE) cptr (size cptr) (only_cnode_caps (ctes_of a)) = rab_ret \<and> (fst (theRight rab_ret) = thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ep_cap) \<and> (fst (theRight rab_ret) \<noteq> thread + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ep_cap) (fst (theRight rab_ret)) a) \<and> ko_at' ep (capEPPtr (cteCap ep_cap)) a \<and> (\<forall>x. bound_tcb_at' ((=) (Some x)) thread a \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) x a) \<and> tcb_at' thread a \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap replyCTE)) a \<and> ksCurThread a = thread \<and> thread \<noteq> ksIdleThread a \<and> tcb_at' (capTCBPtr (cteCap replyCTE)) a \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap replyCTE)) a)) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True) and (?P3109 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest callerDom asidMap v and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) and ((\<lambda>a. highest) and (\<lambda>a. True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> True)))) x))) s) \<and> (callerDom \<noteq> curDom \<longrightarrow> True)\<rbrace>
 3. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE); highest\<rbrakk> \<Longrightarrow> \<lbrace>?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest\<rbrace> gets (\<lambda>a. armKSASIDMap (ksArchState a)) \<lbrace>\<lambda>asidMap s. ((\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> (?P705 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest asidMap and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> ((\<nexists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap vTableCTE))) \<in> ran asidMap} = {v}) \<longrightarrow> True)\<rbrace>
 4. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None vTableCTE curDom callerPrio\<rbrace> gets (\<lambda>s. ksReadyQueuesL1Bitmap s curDom = 0 \<or> lookupBitmapPriority curDom s \<le> callerPrio) \<lbrace>\<lambda>highest s. (highest \<longrightarrow> (?P672 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom callerPrio highest and (\<lambda>_. True)) s) \<and> (\<not> highest \<longrightarrow> True)\<rbrace>
 5. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom\<rbrace> threadGet tcbPriority (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>a. ?P638 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom a and (\<lambda>a. True)\<rbrace>
 6. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None; isValidVTableRoot (cteCap vTableCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE\<rbrace> curDomain \<lbrace>\<lambda>curDom. ?P599 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE curDom and tcb_at' (capTCBPtr (cteCap replyCTE))\<rbrace>
 7. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread; callerFault = None\<rbrakk> \<Longrightarrow> \<lbrace>?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE None\<rbrace> getCTE (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot) \<lbrace>\<lambda>vTableCTE s. (isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> (?P571 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault vTableCTE and (\<lambda>_. True)) s) \<and> (\<not> isValidVTableRoot (cteCap vTableCTE) \<longrightarrow> True)\<rbrace>
 8. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep; isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE); capTCBPtr (cteCap replyCTE) \<noteq> thread\<rbrakk> \<Longrightarrow> \<lbrace>?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap False ep replyCTE\<rbrace> threadGet tcbFault (capTCBPtr (cteCap replyCTE)) \<lbrace>\<lambda>callerFault s. (callerFault = None \<longrightarrow> (?P537 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE callerFault and cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap replyCTE) + 2 ^ cte_level_bits * tcbVTableSlot)) s) \<and> (callerFault \<noteq> None \<longrightarrow> True)\<rbrace>
 9. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> epa; \<not> isSendEP ep\<rbrakk> \<Longrightarrow> \<lbrace>?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep\<rbrace> getCTE (thread + 2 ^ cte_level_bits * tcbCallerSlot) \<lbrace>\<lambda>replyCTE s. (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE) \<longrightarrow> capTCBPtr (cteCap replyCTE) \<noteq> thread \<longrightarrow> (?P483 thread msgInfo cptr cTableCTE rab_ret ep_cap epa ep replyCTE and tcb_at' (capTCBPtr (cteCap replyCTE))) s) \<and> (\<not> (isReplyCap (cteCap replyCTE) \<and> \<not> capReplyMaster (cteCap replyCTE)) \<longrightarrow> True)\<rbrace>
 10. \<And>thread msgInfo cptr cTableCTE rab_ret ep_cap ep. \<lbrakk>isRight rab_ret; msgExtraCaps (messageInfoFromWord msgInfo) = 0; msgLength (messageInfoFromWord msgInfo) \<le> word_of_nat size_msgRegisters; isEndpointCap (cteCap ep_cap) \<and> capEPCanReceive (cteCap ep_cap); \<not> ep\<rbrakk> \<Longrightarrow> \<lbrace>?P404 thread msgInfo cptr cTableCTE rab_ret ep_cap ep\<rbrace> getEndpoint (capEPPtr (cteCap ep_cap)) \<lbrace>\<lambda>epa s. (\<not> isSendEP epa \<longrightarrow> ?Q432 thread msgInfo cptr cTableCTE rab_ret ep_cap ep epa s) \<and> (\<not> \<not> isSendEP epa \<longrightarrow> True)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>s. invs' s \<and> ct_in_state' ((=) Structures_H.thread_state.Running) s \<and> ksSchedulerAction s = ResumeCurrentThread \<and> cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s) \<Longrightarrow> fastpathKernelAssertions s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s
 2. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> ksIdleThread s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s\<rbrakk> \<Longrightarrow> ksCurThread s \<noteq> ksIdleThread s
 2. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs' s; ct_in_state' ((=) Structures_H.thread_state.Running) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rv. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>rva. obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s \<longrightarrow> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> tcbFault tcb = None \<and> msgExtraCaps (messageInfoFromWord rv) = 0 \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> tcb_at' (ksCurThread s) s \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> tcb_at' (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> tcb_at' (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> tcb_at' (ksCurThread s) s \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s) \<and> tcb_at' (ksCurThread s) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> cte_wp_at' (\<lambda>_. True) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters\<rbrakk> \<Longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s \<longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> ((\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> valid_objs' s \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> (\<forall>tcb. ko_at' tcb (ksCurThread s) s \<longrightarrow> (if tcbBoundNotification tcb = None then \<lambda>_. True else ntfn_at' (the (tcbBoundNotification tcb))) s)) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) \<and> valid_objs' s) \<and> True proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s\<rbrakk> \<Longrightarrow> (isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> (isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)) proof (prove)
goal (2 subgoals):
 1. \<And>s rv rva tcb cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s\<rbrakk> \<Longrightarrow> isCNodeCap (cteCap cte) \<longrightarrow> (\<exists>slot. cte_wp_at' (\<lambda>ctea. cteCap ctea = cteCap cte) slot s)
 2. \<And>s rv rva tcb cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s\<rbrakk> \<Longrightarrow> isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s\<rbrakk> \<Longrightarrow> isRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))) \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)))) \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) (fst (theRight (resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s))))) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b)\<rbrakk> \<Longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) a s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) a s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) a s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) a s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s\<rbrakk> \<Longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) a s \<longrightarrow> isEndpointCap (cteCap ctea) \<and> capEPCanReceive (cteCap ctea) \<longrightarrow> (\<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s) \<longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) a s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; isEndpointCap (cteCap ctea); capEPCanReceive (cteCap ctea); \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s\<rbrakk> \<Longrightarrow> (\<forall>ep. ko_at' ep (capEPPtr (cteCap ctea)) s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> isReplyCap (cteCap cteb) \<and> \<not> capReplyMaster (cteCap cteb) \<longrightarrow> capTCBPtr (cteCap cteb) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctec) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap cteb)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap cteb)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap cteb)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap cteb)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap cteb)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap cteb)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap cteb)) s \<longrightarrow> (\<forall>ctec. cte_wp_at' ((=) ctec) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctec) \<noteq> 0 \<and> mdbNext (cteMDBNode ctec) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> isReplyCap (cteCap cte)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctec)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<not> isCNodeCap (cteCap a)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (a = ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap ctea) \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap ctea) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap cteb)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap cteb)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap cteb)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap cteb))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. isReplyCap (cteCap cte)) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap cteb) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap cteb)) s)) \<and> ep_at' (capEPPtr (cteCap ctea)) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5) \<and> ep_at' v0 s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5\<rbrakk> \<Longrightarrow> \<forall>ep. ko_at' ep v0 s \<longrightarrow> \<not> isSendEP ep \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> (\<exists>v0 v1 v2. cteCap ctea = capability.ReplyCap v0 v1 v2) \<and> \<not> capReplyMaster (cteCap ctea) \<longrightarrow> capTCBPtr (cteCap ctea) \<noteq> ksCurThread s \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap cteb) \<longrightarrow> (\<forall>tcb. ko_at' tcb (capTCBPtr (cteCap ctea)) s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cteb))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap ctea)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap ctea)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap ctea)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap ctea)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap ctea)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap ctea)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap ctea)) s \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap ctea)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap ctea)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap ctea)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap ctea))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s)))) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap cteb))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba (capTCBPtr (cteCap ctea)) s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap ctea)) s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) (capTCBPtr (cteCap ctea)) s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) (capTCBPtr (cteCap ctea)) s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) (capTCBPtr (cteCap ctea)) s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) (capTCBPtr (cteCap ctea)) s \<and> (st_tcb_at' isReply (capTCBPtr (cteCap ctea)) s \<longrightarrow> (\<forall>cteb. cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode cteb)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) (capTCBPtr (cteCap ctea)) s \<and> fastpathBestSwitchCandidate (capTCBPtr (cteCap ctea)) s)) \<and> (\<forall>st. st_tcb_at' ((=) st) (capTCBPtr (cteCap ctea)) s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) (capTCBPtr (cteCap ctea))) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap ctea)) s)))) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s)) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) \<and> cte_wp_at' (\<lambda>_. True) (capTCBPtr (cteCap ctea) + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' (capTCBPtr (cteCap ctea)) s) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' v0a s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' v0a s)) \<and> tcb_at' v0a s) \<and> cte_wp_at' (\<lambda>_. True) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' v0a s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; valid_cap' (capability.ReplyCap v0a False v2a) s\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> tcbFault tcb = None \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' v0a s) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s)))) \<and> tcb_at' v0a s)) \<and> tcb_at' v0a s) \<and> cte_wp_at' (\<lambda>_. True) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s) \<and> tcb_at' v0a s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None\<rbrakk> \<Longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s))))))) \<and> cte_wp_at' (\<lambda>_. True) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; cte_wp_at' ((=) cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; cte_wp_at' (\<lambda>_. True) a s; cte_wp_at' ((=) ctea) a s; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; cte_wp_at' ((=) cteb) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None\<rbrakk> \<Longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (v0a + 2 ^ cte_level_bits * tcbVTableSlot) s \<longrightarrow> isValidVTableRoot (cteCap ctea) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s))))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctea))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcba. ko_at' tcba v0a s \<longrightarrow> tcbDomain tcba = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> word_of_nat (length TCB_H.msgRegisters) \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> (\<forall>ctea. cte_wp_at' ((=) ctea) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<longrightarrow> mdbPrev (cteMDBNode ctea) \<noteq> 0 \<and> mdbNext (cteMDBNode ctea) = 0 \<longrightarrow> (\<exists>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s) \<longrightarrow> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. cte_wp_at' ((=) cte) (mdbPrev (cteMDBNode ctea)) s \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> (2 ^ cte_level_bits * tcbCTableSlot \<noteq> 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = cteCap cte) (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) s) \<and> cte_wp_at' (\<lambda>a. \<forall>v0 v1 v2 v3. cteCap a \<noteq> capability.CNodeCap v0 v1 v2 v3) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> (a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> cte_wp_at' (\<lambda>a. cteCap a = capability.EndpointCap v0 v1 v2 True v4 v5) a s) \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) \<and> (\<forall>st. st_tcb_at' ((=) st) v0a s \<longrightarrow> isReply st \<longrightarrow> inj (case_bool (ksCurThread s) v0a) \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> cte_wp_at' (\<lambda>cte. \<exists>v0 v1 v2. cteCap cte = capability.ReplyCap v0 v1 v2) (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s) \<and> valid_mdb' s \<and> (\<forall>x. tcb_at' (case x of True \<Rightarrow> ksCurThread s | False \<Rightarrow> capTCBPtr (cteCap cteb)) s))))))) \<and> True proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s\<rbrakk> \<Longrightarrow> (ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> 4 \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)))) \<and> (lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb \<longrightarrow> (\<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}) \<longrightarrow> (\<forall>tcb. ko_at' tcb v0a s \<longrightarrow> tcbDomain tcb = ksCurDomain s \<longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> 4 \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)))) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> word_of_nat size_msgRegisters; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; \<exists>v. {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> msgLength (messageInfoFromWord rv) \<le> 4 \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (2 subgoals):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s))
 2. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}\<rbrakk> \<Longrightarrow> fastpathBestSwitchCandidate v0a s proof (prove)
goal (2 subgoals):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}\<rbrakk> \<Longrightarrow> fastpathBestSwitchCandidate v0a s
 2. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (2 subgoals):
 1. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> fastpathBestSwitchCandidate v0a s
 2. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (4 subgoals):
 1. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> tcbPriority tcb \<le> tcbPriority tcba \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba
 2. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> ko_at' tcba v0a s
 3. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> ko_at' tcb (ksCurThread s) s
 4. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (3 subgoals):
 1. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> ko_at' tcba v0a s
 2. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec v kob. \<lbrakk>invs' s; Structures_H.thread_state.Running = tcbState tcb; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. Some ntfnptr = tcbBoundNotification tcb \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcba; tcbDomain tcba = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; ko_at' kob a s; ko_at' ep v0 s; ko_at' tcba v0a s; ko_at' tcb (ksCurThread s) s\<rbrakk> \<Longrightarrow> ko_at' tcb (ksCurThread s) s
 3. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s \<and> fastpathBestSwitchCandidate v0a s)) proof (prove)
goal (1 subgoal):
 1. \<And>s rv rva tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a tcba ctec tcbb tcbc v. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s; obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) Thread_H.capRegister = rva) (ksCurThread s) s; ko_at' tcb (ksCurThread s) s; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord rv) = 0; msgLength (messageInfoFromWord rv) \<le> 4; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCTableSlot) = Some cte; resolveAddressBitsFn (cteCap cte) rva (size rva) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcb_at' v0a s; ko_at' tcba v0a s; tcbFault tcba = None; ctes_of s (v0a + 2 ^ cte_level_bits * tcbVTableSlot) = Some ctec; isValidVTableRoot (cteCap ctec); ko_at' tcbb v0a s; ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbb; ko_at' tcbc v0a s; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s\<rbrakk> \<Longrightarrow> (\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<and> ((\<exists>v. obj_at' (\<lambda>tcb. tcbIPCBuffer tcb = v) v0a s) \<longrightarrow> obj_at' (\<lambda>tcb. tcbFault tcb = None) v0a s \<and> obj_at' (\<lambda>tcb. tcbFault tcb = None \<and> atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister = rv) (ksCurThread s) s \<and> obj_at' (\<lambda>a. tcbPriority a = tcbPriority tcbb) v0a s \<and> obj_at' (\<lambda>a. tcbDomain a = ksCurDomain s) v0a s \<and> (st_tcb_at' isReply v0a s \<longrightarrow> mdbPrev (cteMDBNode cteb) \<noteq> 0 \<and> mdbNext (cteMDBNode cteb) = 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte) \<longrightarrow> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> (\<forall>v0 v1 v2. cteCap cte \<noteq> capability.ReplyCap v0 v1 v2)) \<or> (\<forall>cte. ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cte \<longrightarrow> \<not> capReplyMaster (cteCap cte)) \<or> (2 ^ cte_level_bits * tcbCTableSlot = 2 ^ cte_level_bits * tcbCallerSlot \<longrightarrow> capability.NullCap = cteCap cte) \<and> a \<noteq> ksCurThread s + 2 ^ cte_level_bits * tcbCallerSlot \<and> obj_at' (\<lambda>tcb. \<not> tcbQueued tcb) v0a s)) proof (prove)
goal (1 subgoal):
 1. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a ctec tcbc v cted v0b v1b v2b. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbs_of s (ksCurThread s) = Some tcb; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 0x30) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbs_of s v0a = Some tcbc; tcbFault tcbc = None; ctes_of s (v0a + 0x10) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbc; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s; st_tcb_at' isReply v0a s; mdbPrev (cteMDBNode cteb) \<noteq> 0; mdbNext (cteMDBNode cteb) = 0; a = ksCurThread s + 0x30 \<or> tcbQueued tcbc; ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cted; cteCap cted = capability.ReplyCap v0b True v2b; v1b\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s tcb cte a b ctea v0 v1 v2 v3 v4 v5 ep cteb v0a v1a v2a ctec tcbc v cted v0b v1b v2b. \<lbrakk>invs' s; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; cnode_caps_gsCNodes (only_cnode_caps (ctes_of s)) (gsCNodes s); fastpathKernelAssertions s; ksCurThread s \<noteq> ksIdleThread s; tcbs_of s (ksCurThread s) = Some tcb; tcbFault tcb = None; msgExtraCaps (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) = 0; msgLength (messageInfoFromWord (atcbContextGet (tcbArch tcb) TCB_H.msgInfoRegister)) \<le> 4; ctes_of s (ksCurThread s) = Some cte; resolveAddressBitsFn (cteCap cte) (atcbContextGet (tcbArch tcb) Thread_H.capRegister) (size (atcbContextGet (tcbArch tcb) Thread_H.capRegister)) (only_cnode_caps (ctes_of s)) = Inr (a, b); valid_cap' (cteCap cte) s; real_cte_at' a s; ctes_of s a = Some ctea; v3; \<forall>ntfnptr. bound_tcb_at' ((=) (Some ntfnptr)) (ksCurThread s) s \<longrightarrow> obj_at' (\<lambda>a. \<not> EndpointDecls_H.isActive a) ntfnptr s; cteCap ctea = capability.EndpointCap v0 v1 v2 True v4 v5; capAligned (capability.EndpointCap v0 v1 v2 True v4 v5); ep_at' v0 s; ko_at' ep v0 s; \<not> isSendEP ep; ctes_of s (ksCurThread s + 0x30) = Some cteb; \<not> v1a; cteCap cteb = capability.ReplyCap v0a False v2a; v0a \<noteq> ksCurThread s; capAligned (capability.ReplyCap v0a False v2a); tcbs_of s v0a = Some tcbc; tcbFault tcbc = None; ctes_of s (v0a + 0x10) = Some ctec; isValidVTableRoot (cteCap ctec); ksReadyQueuesL1Bitmap s (ksCurDomain s) = 0 \<or> lookupBitmapPriority (ksCurDomain s) s \<le> tcbPriority tcbc; tcbDomain tcbc = ksCurDomain s; {hwasid. (hwasid, capPDBasePtr (capCap (cteCap ctec))) \<in> ran (armKSASIDMap (ksArchState s))} = {v}; fastpathBestSwitchCandidate v0a s; st_tcb_at' isReply v0a s; mdbPrev (cteMDBNode cteb) \<noteq> 0; mdbNext (cteMDBNode cteb) = 0; a = ksCurThread s + 0x30 \<or> tcbQueued tcbc; ctes_of s (mdbPrev (cteMDBNode cteb)) = Some cted; cteCap cted = capability.ReplyCap v0b True v2b; v1b; obj_at' (\<lambda>a. \<not> tcbQueued a) v0a s\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!