theory Syscall_R

lemma handleInvocation_corres:
  "c \<longrightarrow> b \<Longrightarrow>
   corres (dc \<oplus> dc)
          (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active)
          (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and
           (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active')
          (handle_invocation c b)
          (handleInvocation c b)" apply (simp add: handle_invocation_def handleInvocation_def liftE_bindE) apply (rule corres_guard_imp) apply (rule corres_split_eqr[OF getCurThread_corres]) apply (rule corres_split[OF getMessageInfo_corres]) apply clarsimp apply (simp add: liftM_def cap_register_def capRegister_def) apply (rule corres_split_eqr[OF asUser_getRegister_corres]) apply (rule syscall_corres) apply (rule hinv_corres_assist, simp) apply (clarsimp simp add: when_def) apply (rule handleFault_corres) apply simp apply (simp add: split_def) apply (rule corres_split[OF getMRs_corres]) apply (rule decodeInvocation_corres, simp_all)[1] apply (fastforce simp: list_all2_map2 list_all2_map1 elim:  list_all2_mono) apply (fastforce simp: list_all2_map2 list_all2_map1 elim:  list_all2_mono) apply wp[1] apply (drule sym[OF conjunct1]) apply simp apply wp[1] apply (clarsimp simp: when_def) apply (rule replyFromKernel_corres) apply (rule corres_split[OF setThreadState_corres]) apply simp apply (rule corres_splitEE) apply (rule performInvocation_corres; simp) apply simp apply (rule corres_split[OF getThreadState_corres]) apply (rename_tac state state') apply (case_tac state, simp_all)[1] apply (fold dc_def)[1] apply (rule corres_split) apply (rule corres_when [OF refl replyFromKernel_corres]) apply (rule setThreadState_corres) apply simp apply (simp add: when_def) apply (rule conjI, rule impI) apply (rule reply_from_kernel_tcb_at) apply (rule impI, wp+) apply simp+ apply (wp hoare_drop_imps)+ apply simp apply wp apply simp apply (rule_tac Q="\<lambda>rv. einvs and simple_sched_action and valid_invocation rve
                                   and (\<lambda>s. thread = cur_thread s)
                                   and st_tcb_at active thread"
                          in hoare_post_imp) apply (clarsimp simp: simple_from_active ct_in_state_def
                               elim!: st_tcb_weakenE) apply (wp sts_st_tcb_at' set_thread_state_simple_sched_action
                set_thread_state_active_valid_sched) apply (rule_tac Q="\<lambda>rv. invs' and valid_invocation' rve'
                                      and (\<lambda>s. thread = ksCurThread s)
                                      and st_tcb_at' active' thread
                                      and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread)
                                      and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))"
                         in hoare_post_imp) apply (clarsimp simp: ct_in_state'_def) apply (frule(1) ct_not_ksQ) apply (clarsimp) apply (wp setThreadState_nonqueued_state_update
                        setThreadState_st_tcb setThreadState_rct)[1] apply (wp lec_caps_to lsft_ex_cte_cap_to
                    | simp add: split_def liftE_bindE[symmetric]
                                ct_in_state'_def ball_conj_distrib
                    | rule hoare_vcg_E_elim)+ apply (clarsimp simp: tcb_at_invs invs_valid_objs
                         valid_tcb_state_def ct_in_state_def
                         simple_from_active invs_mdb) apply (clarsimp simp: msg_max_length_def word_bits_def) apply (erule st_tcb_ex_cap, clarsimp+) apply fastforce apply (clarsimp) apply (frule tcb_at_invs') apply (clarsimp simp: invs'_def valid_state'_def
                        ct_in_state'_def ct_not_inQ_def) apply (frule(1) valid_queues_not_tcbQueued_not_ksQ) apply (frule pred_tcb'_weakenE [where P=active' and P'=simple'], clarsimp) apply (frule(1) st_tcb_ex_cap'', fastforce) apply (clarsimp simp: valid_pspace'_def) apply (frule(1) st_tcb_at_idle_thread') apply (simp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') (handle_invocation c b) (handleInvocation c b) proof (prove)
goal (1 subgoal):
 1. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') (do thread <- gets cur_thread;
info <- get_message_info thread;
ptr <- liftM to_bl (as_user thread (getRegister cap_register));
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure (of_bl ptr) False (lookup_cap_and_slot thread ptr);
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do thread <- getCurThread;
info <- getMessageInfo thread;
ptr <- asUser thread (getRegister Thread_H.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer info;
global.decodeInvocation (msgLabel info) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od) proof (prove)
goal (3 subgoals):
 1. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) ?Q ?Q' (do thread <- gets cur_thread;
info <- get_message_info thread;
ptr <- liftM to_bl (as_user thread (getRegister cap_register));
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure (of_bl ptr) False (lookup_cap_and_slot thread ptr);
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do thread <- getCurThread;
info <- getMessageInfo thread;
ptr <- asUser thread (getRegister Thread_H.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer info;
global.decodeInvocation (msgLabel info) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od)
 2. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ?Q s
 3. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ?Q' s proof (prove)
goal (5 subgoals):
 1. \<And>thread. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (?R4 thread) (?R'4 thread) (do info <- get_message_info thread;
ptr <- liftM to_bl (as_user thread (getRegister cap_register));
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure (of_bl ptr) False (lookup_cap_and_slot thread ptr);
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do info <- getMessageInfo thread;
ptr <- asUser thread (getRegister Thread_H.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer info;
global.decodeInvocation (msgLabel info) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od)
 2. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>?R4\<rbrace>
 3. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>?R'4\<rbrace>
 4. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 5. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>thread info infoa. \<lbrakk>c \<longrightarrow> b; ((=) \<circ> message_info_map) info infoa\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R8 thread info) (?R'8 thread infoa) (do ptr <- liftM to_bl (as_user thread (getRegister cap_register));
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure (of_bl ptr) False (lookup_cap_and_slot thread ptr);
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do ptr <- asUser thread (getRegister Thread_H.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer infoa;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer infoa;
global.decodeInvocation (msgLabel infoa) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od)
 2. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>?R8 thread\<rbrace>
 3. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>?R'8 thread\<rbrace>
 4. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
 5. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'8 thread\<rbrace>
 6. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (?R8 thread info) (?R'8 thread (message_info_map info)) (do ptr <- liftM to_bl (as_user thread (getRegister cap_register));
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure (of_bl ptr) False (lookup_cap_and_slot thread ptr);
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do ptr <- asUser thread (getRegister Thread_H.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od)
 2. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>?R8 thread\<rbrace>
 3. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>?R'8 thread\<rbrace>
 4. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
 5. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'8 thread\<rbrace>
 6. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (?R8 thread info) (?R'8 thread (message_info_map info)) (do x <- as_user thread (getRegister ARM.capRegister);
Syscall_A.syscall (doE (cap, slot) <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ()))
odE
od)
od) (do ptr <- asUser thread (getRegister ARM.capRegister);
Syscall_H.syscall (doE (cap, slot) <- capFaultOnFailure ptr False (lookupCapAndSlot thread ptr);
do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>(slot, cap, extracaps, buffer). do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args ptr slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od))
odE
od)
od)
 2. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>?R8 thread\<rbrace>
 3. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>?R'8 thread\<rbrace>
 4. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
 5. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'8 thread\<rbrace>
 6. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 7. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> corres (dc \<oplus> dc) (?R16 thread info x) (?R'16 thread info x) (Syscall_A.syscall (doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handle_fault thread fault)) (\<lambda>a. case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (\<lambda>err. when c (reply_from_kernel thread (msg_from_syscall_error err))) (\<lambda>oper. do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c oper;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od)) (Syscall_H.syscall (doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (\<lambda>fault. when b (handleFault thread fault)) (\<lambda>a. case a of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od) (\<lambda>err. when c (replyFromKernel thread (msgFromSyscallError err))) (\<lambda>oper. do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c oper;
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od))
 2. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>?R16 thread info\<rbrace>
 3. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>?R'16 thread info\<rbrace>
 4. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 5. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
 6. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
 7. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'8 thread\<rbrace>
 8. \<And>s. \<lbrakk>c \<longrightarrow> b; (einvs and (\<lambda>s. scheduler_action s = resume_cur_thread) and ct_active) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q4) s
 9. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q'4) s proof (prove)
goal (17 subgoals):
 1. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> corres (fr \<oplus> ?r_flt_rel23 thread info x) (?P23 thread info x) (?P'23 thread info x) (doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE) (doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE)
 2. \<And>thread info x flt flt'. \<lbrakk>c \<longrightarrow> b; flt' = fault_map flt\<rbrakk> \<Longrightarrow> corres dc (?P_flt23 thread info x flt) (?P'_flt23 thread info x flt') (when b (handle_fault thread flt)) (when b (handleFault thread flt'))
 3. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; ?r_flt_rel23 thread info x rv rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od)
 4. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; ?r_flt_rel23 thread info x rv rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; ?r_flt_rel23 thread info x rvf rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 6. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 7. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P_flt23 thread info x\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P'_flt23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. ?P23 thread info x and ?Q23 thread info x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x flt flt'. \<lbrakk>c \<longrightarrow> b; flt' = fault_map flt\<rbrakk> \<Longrightarrow> corres dc (?P_flt23 thread info x flt) (?P'_flt23 thread info x flt') (when b (handle_fault thread flt)) (when b (handleFault thread flt'))
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od)
 3. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P_flt23 thread info x\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P'_flt23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x flt. b \<Longrightarrow> corres dc (?P_flt23 thread info x flt) (?P'_flt23 thread info x (fault_map flt)) (handle_fault thread flt) (handleFault thread (fault_map flt))
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od)
 3. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P_flt23 thread info x\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>?P'_flt23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x flt. b \<Longrightarrow> fr flt (fault_map flt)
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od)
 3. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od) (case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od)
 2. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?P_no_flt23 thread info x rv) (?P'_no_flt23 thread info x rv') (do args <- get_mrs thread (snd (snd (snd rv'))) info;
decode_invocation (mi_label info) args (to_bl x) (fst rv) (fst (snd rv)) (fst (snd (snd rv)))
od) (do args <- getMRs thread (snd (snd (snd rv'))) (message_info_map info);
global.decodeInvocation (mi_label info) args x (cte_map (fst rv)) (fst (snd rv')) (fst (snd (snd rv')))
od)
 2. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P_no_flt23 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. ?P'_no_flt23 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread info x rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv'))); rva = rv'a\<rbrakk> \<Longrightarrow> corres (ser \<oplus> ?r_err_rel23 thread info x rv rv') (?R45 thread info x rv rv' rva) (?R'45 thread info x rv rv' rv'a) (decode_invocation (mi_label info) rva (to_bl x) (fst rv) (fst (snd rv)) (fst (snd (snd rv)))) (global.decodeInvocation (mi_label info) rv'a x (cte_map (fst rv)) (fst (snd rv')) (fst (snd (snd rv'))))
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q48 thread info x rv\<rbrace> get_mrs thread (snd (snd (snd rv'))) info \<lbrace>?R45 thread info x rv rv'\<rbrace>
 3. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>?R'45 thread info x rv rv'\<rbrace>
 4. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; ?r_err_rel23 thread info x rvf rvf' rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 6. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 7. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and ?Q48 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv'))); rva = rv'a\<rbrakk> \<Longrightarrow> list_all2 cap_relation (map fst (fst (snd (snd rv)))) (map fst (fst (snd (snd rv'))))
 2. \<And>rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv'))); rva = rv'a\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) (fst (snd (snd rv))) (fst (snd (snd rv')))
 3. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q48 thread info x rv\<rbrace> get_mrs thread (snd (snd (snd rv'))) info \<lbrace>\<lambda>rva. invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s) and (\<lambda>s. length rva < 2 ^ word_bits)\<rbrace>
 4. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (cte_map (fst rv)) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 5. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 7. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 8. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and ?Q48 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv'))); rva = rv'a\<rbrakk> \<Longrightarrow> list_all2 (\<lambda>p pa. snd pa = cte_map (snd p)) (fst (snd (snd rv))) (fst (snd (snd rv')))
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q48 thread info x rv\<rbrace> get_mrs thread (snd (snd (snd rv'))) info \<lbrace>\<lambda>rva. invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s) and (\<lambda>s. length rva < 2 ^ word_bits)\<rbrace>
 3. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (cte_map (fst rv)) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 4. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 6. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 7. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and ?Q48 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q48 thread info x rv\<rbrace> get_mrs thread (snd (snd (snd rv'))) info \<lbrace>\<lambda>rva. invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s) and (\<lambda>s. length rva < 2 ^ word_bits)\<rbrace>
 2. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (cte_map (fst rv)) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 3. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and ?Q48 thread info x rv and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; fst rv' = cte_map (fst rv) \<and> cap_relation (fst (snd rv)) (fst (snd rv')) \<and> snd (snd (snd rv)) = snd (snd (snd rv')) \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) (fst (snd (snd rv))) (fst (snd (snd rv')))\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (cte_map (fst rv)) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 2. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; cte_map (fst rv) = fst rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (cte_map (fst rv)) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 2. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rv rv'. \<lbrakk>c \<longrightarrow> b; cte_map (fst rv) = fst rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 thread info x rv'\<rbrace> getMRs thread (snd (snd (snd rv'))) (message_info_map info) \<lbrace>\<lambda>rv'a. invs' and valid_cap' (fst (snd rv')) and cte_wp_at' (\<lambda>_. True) (fst rv') and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv'))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 2. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and ?Q'51 thread info x rv and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x rv rv' err err'. \<lbrakk>c \<longrightarrow> b; (case rv of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rv'; err' = syscall_error_map err\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x rv err) (?P'_err23 thread info x rv' err') (when c (reply_from_kernel thread (msg_from_syscall_error err))) (when c (replyFromKernel thread (msgFromSyscallError err')))
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x a ba aa ab ad ae bb err. \<lbrakk>cap_relation aa ad; list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) ab ae; c; b\<rbrakk> \<Longrightarrow> corres dc (?P_err23 thread info x ((a, ba), aa, ab, bb) err) (?P'_err23 thread info x (cte_map (a, ba), ad, ae, bb) (syscall_error_map err)) (reply_from_kernel thread (msg_from_syscall_error err)) (replyFromKernel thread (msg_from_syscall_error err))
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>?P_err23 thread info x rv\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>?P'_err23 thread info x rv'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?P_no_err23 thread info x rvf rve) (?P'_no_err23 thread info x rvf' rve') (do y <- set_thread_state thread Structures_A.thread_state.Restart;
doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE
od) (do y <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE
od)
 2. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>?P_no_err23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 3. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>?P'_no_err23 thread info x rv'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 4. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 6. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 8. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
 10. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Restart Structures_H.thread_state.Restart
 2. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R134 thread info x rvf rvf' rve rve' rv) (?R'134 thread info x rvf rvf' rve rve' rv') (doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE) (doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE)
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>?R134 thread info x rvf rvf' rve rve'\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?R'134 thread info x rvf rvf' rve rve'\<rbrace>
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R134 thread info x rvf rvf' rve rve' rv) (?R'134 thread info x rvf rvf' rve rve' rv') (doE reply <- perform_invocation b c rve;
liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, reply));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)
odE) (doE reply <- global.performInvocation b c rve';
liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, reply));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od)
odE)
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>?R134 thread info x rvf rvf' rve rve'\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?R'134 thread info x rvf rvf' rve rve'\<rbrace>
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> corres (dc \<oplus> ?r'144 thread info x rvf rvf' rve rve' rv rv') (?P145 thread info x rvf rvf' rve rve' rv) (?P'147 thread info x rvf rvf' rve rve' rv') (perform_invocation b c rve) (global.performInvocation b c rve')
 2. \<And>thread info x rvf rvf' rve rve' rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'; ?r'144 thread info x rvf rvf' rve rve' rv rv' rva rv'a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R144 thread info x rvf rvf' rve rve' rv rv' rva) (?R'144 thread info x rvf rvf' rve rve' rv rv' rv'a) (liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, rva));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)) (liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od))
 3. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>?R144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>?R'144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. ?P145 thread info x rvf rvf' rve rve' rv and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. ?P'147 thread info x rvf rvf' rve rve' rv' and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 7. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 8. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv rv' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'; rva = rv'a\<rbrakk> \<Longrightarrow> corres (dc \<oplus> dc) (?R144 thread info x rvf rvf' rve rve' rv rv' rva) (?R'144 thread info x rvf rvf' rve rve' rv rv' rv'a) (liftE (do a <- get_thread_state thread;
case a of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, rva));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()
od)) (liftE (do a <- getThreadState thread;
case a of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ()
od))
 2. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>?R144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>?R'144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 6. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 7. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> corres dc (?R144 thread info x rvf rvf' rve rve' () () rv'a) (?R'144 thread info x rvf rvf' rve rve' () () rv'a) (get_thread_state thread >>= Structures_A.thread_state.case_thread_state (return ()) (return ()) (do y <- when c (reply_from_kernel thread (0, rv'a));
set_thread_state thread Structures_A.thread_state.Running
od) (\<lambda>word receiver_payload_ext. return ()) (\<lambda>word sender_payload_ext. return ()) (return ()) (\<lambda>word. return ()) (return ())) (getThreadState thread >>= Structures_H.thread_state.case_thread_state (\<lambda>word bool. return ()) (return ()) (\<lambda>word. return ()) (return ()) (return ()) (return ()) (\<lambda>word1 word2 bool1 bool2 bool3. return ()) (do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od))
 2. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>?R144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>?R'144 thread info x rvf rvf' rve rve' rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 6. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 7. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 9. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; thread_state_relation rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R165 thread info x rvf rvf' rve rve' rva rv'a rv) (?R'165 thread info x rvf rvf' rve rve' rva rv'a rv') (case rv of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, rv'a));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()) (case rv' of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ())
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>?R165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>?R'165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 8. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 9. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; thread_state_relation state state'\<rbrakk> \<Longrightarrow> corres dc (?R165 thread info x rvf rvf' rve rve' rva rv'a state) (?R'165 thread info x rvf rvf' rve rve' rva rv'a state') (case state of Structures_A.thread_state.Restart \<Rightarrow> do y <- when c (reply_from_kernel thread (0, rv'a));
set_thread_state thread Structures_A.thread_state.Running
od | _ \<Rightarrow> return ()) (case state' of Structures_H.thread_state.Restart \<Rightarrow> do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od | _ \<Rightarrow> return ())
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>?R165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>?R'165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 8. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 9. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> corres (\<lambda>a b. True) (?R165 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart) (?R'165 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart) (do y <- when c (reply_from_kernel thread (0, rv'a));
set_thread_state thread Structures_A.thread_state.Running
od) (do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od)
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>?R165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>?R'165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 8. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 9. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> corres dc (?R165 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart) (?R'165 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart) (do y <- when c (reply_from_kernel thread (0, rv'a));
set_thread_state thread Structures_A.thread_state.Running
od) (do y <- when c (replyFromKernel thread (0, rv'a));
setThreadState Structures_H.thread_state.Running thread
od)
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>?R165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>?R'165 thread info x rvf rvf' rve rve' rva rv'a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 8. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 9. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 10. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> corres (?r'181 thread info x rvf rvf' rve rve' rva rv'a state state') (?P192 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart) (?P'188 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart) (when c (reply_from_kernel thread (0, rv'a))) (when c (replyFromKernel thread (0, rv'a)))
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart; ?r'181 thread info x rvf rvf' rve rve' rva rv'a state state' rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R181 thread info x rvf rvf' rve rve' rva rv'a state state' rv) (?R'181 thread info x rvf rvf' rve rve' rva rv'a state state' rv') (set_thread_state thread Structures_A.thread_state.Running) (setThreadState Structures_H.thread_state.Running thread)
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> when c (reply_from_kernel thread (0, rv'a)) \<lbrace>?R181 thread info x rvf rvf' rve rve' rva rv'a state state'\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>?R'181 thread info x rvf rvf' rve rve' rva rv'a state state'\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. ?P192 thread info x rvf rvf' rve rve' rva rv'a a and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. ?P'188 thread info x rvf rvf' rve rve' rva rv'a a and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 10. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart; dc rv rv'\<rbrakk> \<Longrightarrow> corres dc (?R181 thread info x rvf rvf' rve rve' rva rv'a state state' rv) (?R'181 thread info x rvf rvf' rve rve' rva rv'a state state' rv') (set_thread_state thread Structures_A.thread_state.Running) (setThreadState Structures_H.thread_state.Running thread)
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> when c (reply_from_kernel thread (0, rv'a)) \<lbrace>?R181 thread info x rvf rvf' rve rve' rva rv'a state state'\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>?R'181 thread info x rvf rvf' rve rve' rva rv'a state state'\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 9. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 10. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart; dc rv rv'\<rbrakk> \<Longrightarrow> thread_state_relation Structures_A.thread_state.Running Structures_H.thread_state.Running
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> when c (reply_from_kernel thread (0, rv'a)) \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>\<lambda>rv'. tcb_at' thread\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 9. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 10. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> when c (reply_from_kernel thread (0, rv'a)) \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>\<lambda>rv'. tcb_at' thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 9. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 10. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> (c \<longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> reply_from_kernel thread (0, rv'a) \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>) \<and> (\<not> c \<longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> return () \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>)
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>\<lambda>rv'. tcb_at' thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 9. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 10. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart; c\<rbrakk> \<Longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> reply_from_kernel thread (0, rv'a) \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<not> c \<longrightarrow> \<lbrace>?Q190 thread info x rvf rvf' rve rve' rv'a rv'a Structures_A.thread_state.Restart\<rbrace> return () \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>\<lambda>rv'. tcb_at' thread\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and ?Q190 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 9. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 10. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<not> c \<longrightarrow> \<lbrace>tcb_at thread\<rbrace> return () \<lbrace>\<lambda>rv. tcb_at thread\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve' rva rv'a state state'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a; state' = Structures_H.thread_state.Restart; state = Structures_A.thread_state.Restart\<rbrakk> \<Longrightarrow> \<lbrace>?Q'186 thread info x rvf rvf' rve rve' rv'a rv'a Structures_H.thread_state.Restart\<rbrace> when c (replyFromKernel thread (0, rv'a)) \<lbrace>\<lambda>rv'. tcb_at' thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q171 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> get_thread_state thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at thread and invs) a) and tcb_at thread\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve' rva rv'a. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; rva = rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'169 thread info x rvf rvf' rve rve' () () rv'a\<rbrace> getThreadState thread \<lbrace>\<lambda>a. (\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and ?Q'186 thread info x rvf rvf' rve rve' rva rv'a a\<rbrace>
 5. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q146 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>a. tcb_at thread and ?Q171 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ?Q'169 thread info x rvf rvf' rve rve' rv rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and ?Q146 thread info x rvf rvf' rve rve' rv\<rbrace>
 8. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 9. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 10. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
A total of 20 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'242 thread info x rvf rvf' rve rve' rv\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>rv s. (c \<longrightarrow> (tcb_at thread and invs) s) \<and> tcb_at thread s\<rbrace>, -
 2. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ((\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and (if c then tcb_at' thread else tcb_at' thread))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. True \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> ?P'242 thread info x rvf rvf' rve rve' rv s)\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?P'242 thread info x rvf rvf' rve rve' ()\<rbrace> perform_invocation b c rve \<lbrace>\<lambda>rv s. (c \<longrightarrow> tcb_at thread s \<and> invs s) \<and> tcb_at thread s\<rbrace>, -
 2. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>a. tcb_at' thread and ((\<lambda>a. c \<longrightarrow> (tcb_at' thread and invs') a) and (if c then tcb_at' thread else tcb_at' thread))\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. True \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> ?P'242 thread info x rvf rvf' rve rve' rv s)\<rbrace>
 4. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and ?Q'148 thread info x rvf rvf' rve rve' rv'\<rbrace>
 5. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 6. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 8. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 10. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv rv'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'276 thread info x rvf rvf' rve rve' rv'\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>rv. if c then tcb_at' thread else tcb_at' thread\<rbrace>, -
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. True \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> ((invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> (invs and ct_active and valid_invocation rve) s) \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s)\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> ?P'276 thread info x rvf rvf' rve rve' rv' s)\<rbrace>
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?P'276 thread info x rvf rvf' rve rve' ()\<rbrace> global.performInvocation b c rve' \<lbrace>\<lambda>rv. tcb_at' thread\<rbrace>, -
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. True \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> ((invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> (invs and ct_active and valid_invocation rve) s) \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s)\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> ?P'276 thread info x rvf rvf' rve rve' rv' s)\<rbrace>
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. True \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> ((invs and st_tcb_at active thread and ct_active and valid_invocation rve) s \<and> (invs and ct_active and valid_invocation rve) s) \<and> (invs and st_tcb_at active thread and ct_active and valid_invocation rve) s)\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s)\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv s. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'; (einvs and simple_sched_action and valid_invocation rve and (\<lambda>s. thread = cur_thread s) and st_tcb_at active thread) s\<rbrakk> \<Longrightarrow> (einvs and valid_invocation rve and simple_sched_action and ct_active and (\<lambda>s. (\<exists>w w2 b c. rve = Invocations_A.invocation.InvokeEndpoint w w2 b c) \<longrightarrow> st_tcb_at (\<lambda>st. inactive st \<or> st = Structures_A.thread_state.Running \<or> st = Structures_A.thread_state.Restart \<or> idle st \<or> awaiting_reply st) (cur_thread s) s) and (\<lambda>s. invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> ct_active s \<and> valid_invocation rve s \<and> invs s \<and> st_tcb_at active thread s \<and> ct_active s \<and> valid_invocation rve s)) s
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and simple_sched_action and valid_invocation rve and (\<lambda>s. thread = cur_thread s) and st_tcb_at active thread\<rbrace>
 3. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)\<rbrace>
 4. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 5. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 7. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 9. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', ab). p' = cte_map p \<and> (case ab of (capa, ab) \<Rightarrow> cap_relation cap capa \<and> (case ab of (extracapsa, buffera) \<Rightarrow> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa))) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q137 thread info x rvf rve\<rbrace> set_thread_state thread Structures_A.thread_state.Restart \<lbrace>\<lambda>rv. einvs and simple_sched_action and valid_invocation rve and (\<lambda>s. thread = cur_thread s) and st_tcb_at active thread\<rbrace>
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and ?Q137 thread info x rv rve\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv'. invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)\<rbrace>
 2. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 3. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 4. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 6. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 8. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
 10. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>thread info x rvf rvf' rve rve' rv s. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'; (invs' and valid_invocation' rve' and (\<lambda>s. thread = ksCurThread s) and st_tcb_at' active' thread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (invs' and sch_act_simple and valid_invocation' rve' and ct_active' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. True \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> ((invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s \<and> (invs' and sch_act_simple and (\<lambda>s. \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)) and ct_active' and valid_invocation' rve') s) \<and> (invs' and st_tcb_at' active' thread and valid_invocation' rve' and ct_active') s)) s
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv. invs' and valid_invocation' rve' and (\<lambda>s. thread = ksCurThread s) and st_tcb_at' active' thread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>aa ab ad ae rve rve' s af bc. \<lbrakk>c \<longrightarrow> b; inv_relation rve rve'; invs' s; cap_relation aa ad; valid_invocation' rve' s; list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) ab ae; st_tcb_at' active' (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; vs_valid_duplicates' (ksPSpace s); ksCurThread s \<in> set (ksReadyQueues s (af, bc))\<rbrakk> \<Longrightarrow> False
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv. invs' and valid_invocation' rve' and (\<lambda>s. thread = ksCurThread s) and st_tcb_at' active' thread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>aa ab ad ae rve rve' s af bc. \<lbrakk>c \<longrightarrow> b; inv_relation rve rve'; invs' s; cap_relation aa ad; valid_invocation' rve' s; list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) ab ae; st_tcb_at' active' (ksCurThread s) s; ksSchedulerAction s = ResumeCurrentThread; vs_valid_duplicates' (ksPSpace s); ksCurThread s \<in> set (ksReadyQueues s (af, bc)); \<forall>p. ksCurThread s \<notin> set (ksReadyQueues s p)\<rbrakk> \<Longrightarrow> False
 2. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv. invs' and valid_invocation' rve' and (\<lambda>s. thread = ksCurThread s) and st_tcb_at' active' thread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 3. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 4. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 6. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 8. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 10. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>thread info x rvf rvf' rve rve'. \<lbrakk>c \<longrightarrow> b; (case rvf of (p, cap, extracaps, buffer) \<Rightarrow> \<lambda>(p', capa, extracapsa, buffera). p' = cte_map p \<and> cap_relation cap capa \<and> buffer = buffera \<and> list_all2 (\<lambda>x y. cap_relation (fst x) (fst y) \<and> snd y = cte_map (snd x)) extracaps extracapsa) rvf'; inv_relation rve rve'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'139 thread info x rvf' rve'\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>rv. invs' and valid_invocation' rve' and (\<lambda>s. thread = ksCurThread s) and st_tcb_at' active' thread and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
 2. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 3. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and ?Q'139 thread info x rv' rve'\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 4. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 5. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 6. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 7. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 8. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 9. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
 10. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>thread info x rv. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q_no_flt23 thread info x rv\<rbrace> case rv of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- get_mrs thread buffer info;
decode_invocation (mi_label info) args (to_bl x) slot cap extracaps
od \<lbrace>\<lambda>rve. tcb_at thread and (\<lambda>s. (st_tcb_at active thread and invs and ex_nonz_cap_to thread) s \<and> valid_list s \<and> (valid_sched and st_tcb_at active thread and (\<lambda>s. active Structures_A.thread_state.Restart)) s \<and> simple_sched_action s \<and> valid_invocation rve s \<and> thread = cur_thread s \<and> K (active Structures_A.thread_state.Restart) s)\<rbrace>, \<lbrace>\<lambda>a. tcb_at thread and invs\<rbrace>
 2. \<And>thread info x rv'. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'_no_flt23 thread info x rv'\<rbrace> case rv' of (slot, a) \<Rightarrow> case a of (cap, a) \<Rightarrow> case a of (extracaps, buffer) \<Rightarrow> do args <- getMRs thread buffer (message_info_map info);
global.decodeInvocation (mi_label info) args x slot cap extracaps
od \<lbrace>\<lambda>rve'. tcb_at' thread and (\<lambda>s. (invs' s \<and> st_tcb_at' simple' thread s \<and> Structures_H.thread_state.Restart \<in> {Structures_H.thread_state.Inactive, Structures_H.thread_state.Running, Structures_H.thread_state.Restart, Structures_H.thread_state.IdleThreadState} \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<longrightarrow> ex_nonz_cap_to' thread s) \<and> (thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple s) \<and> (\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> (\<forall>p. thread \<notin> set (ksReadyQueues s p)))) \<and> valid_invocation' rve' s \<and> thread = ksCurThread s \<and> active' Structures_H.thread_state.Restart \<and> ((runnable' Structures_H.thread_state.Restart \<or> ksCurThread s \<noteq> thread) \<and> ksSchedulerAction s = ResumeCurrentThread) \<and> vs_valid_duplicates' (ksPSpace s))\<rbrace>, \<lbrace>\<lambda>a. tcb_at' thread and invs'\<rbrace>
 3. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q23 thread info x\<rbrace> doE a <- cap_fault_on_failure x False (lookup_cap_and_slot thread (to_bl x));
case a of (cap, slot) \<Rightarrow> do buffer <- lookup_ipc_buffer False thread;
doE extracaps <- lookup_extra_caps thread buffer info;
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at thread and (\<lambda>s. (invs and valid_sched and valid_list and valid_cap (fst (snd rv)) and cte_wp_at (\<lambda>_. True) (fst rv) and cte_wp_at ((=) (fst (snd rv))) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). s \<turnstile> fst x \<and> cte_wp_at (\<lambda>_. True) (snd x) s)) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits)) and ?Q_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>flt. einvs and st_tcb_at active thread and ex_nonz_cap_to thread and (\<lambda>_. valid_fault flt)\<rbrace>
 4. \<And>thread info x. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'23 thread info x\<rbrace> doE a <- capFaultOnFailure x False (lookupCapAndSlot thread x);
case a of (cap, slot) \<Rightarrow> do buffer <- lookupIPCBuffer False thread;
doE extracaps <- lookupExtraCaps thread buffer (message_info_map info);
returnOk (slot, cap, extracaps, buffer)
odE
od
odE \<lbrace>\<lambda>rv. tcb_at' thread and (case snd (snd (snd rv)) of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (invs' and valid_cap' (fst (snd rv)) and cte_wp_at' (\<lambda>_. True) (fst rv) and (\<lambda>s. \<forall>x\<in>set (fst (snd (snd rv))). valid_cap' (fst x) s \<and> cte_wp_at' (\<lambda>_. True) (snd x) s) and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) and ?Q'_no_flt23 thread info x rv\<rbrace>, \<lbrace>\<lambda>a. invs' and sch_act_not thread and (\<lambda>s. \<forall>p. thread \<notin> set (ksReadyQueues s p)) and st_tcb_at' simple' thread and ex_nonz_cap_to' thread\<rbrace>
 5. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q16 thread info\<rbrace> as_user thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs and tcb_at thread and (\<lambda>_. valid_message_info info) and ?Q23 thread info x\<rbrace>
 6. \<And>thread info. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'19 thread (message_info_map info)\<rbrace> asUser thread (getRegister ARM.capRegister) \<lbrace>\<lambda>x. invs' and tcb_at' thread and ?Q'23 thread info x\<rbrace>
 7. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q8 thread\<rbrace> get_message_info thread \<lbrace>\<lambda>info. tcb_at thread and ?Q16 thread info\<rbrace>
 8. \<And>thread. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'8 thread\<rbrace> getMessageInfo thread \<lbrace>\<lambda>a. tcb_at' thread and ?Q'19 thread a\<rbrace>
 9. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q4\<rbrace> gets cur_thread \<lbrace>\<lambda>thread. tcb_at thread and ?Q8 thread\<rbrace>
 10. c \<longrightarrow> b \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCurThread \<lbrace>\<lambda>thread. tcb_at' thread and ?Q'8 thread\<rbrace>
A total of 12 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; invs s \<and> valid_list s \<and> valid_sched s \<and> scheduler_action s = resume_cur_thread \<and> ct_active s\<rbrakk> \<Longrightarrow> tcb_at (cur_thread s) s \<and> valid_mdb s \<and> valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s) \<and> st_tcb_at active (cur_thread s) s \<and> ex_nonz_cap_to (cur_thread s) s \<and> valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s) \<and> st_tcb_at active (cur_thread s) s \<and> ex_nonz_cap_to (cur_thread s) s \<and> tcb_at (cur_thread s) s \<and> valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s) \<and> valid_objs s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits) \<and> tcb_at (cur_thread s) s \<and> st_tcb_at active (cur_thread s) s \<and> ex_nonz_cap_to (cur_thread s) s \<and> valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s) \<and> st_tcb_at active (cur_thread s) s \<and> valid_objs s
 2. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and (invs' and tcb_at' (ksCurThread s) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues sa (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> tcb_at' (ksCurThread s) sa \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> invs' sa \<and> invs' sa \<and> sch_act_simple sa \<and> True \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> True \<and> valid_objs' sa \<and> valid_objs' sa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) sa \<and> invs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> ksCurThread s = ksCurThread sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace sa))))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; invs s; valid_list s; valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); scheduler_action s = resume_cur_thread; st_tcb_at active (cur_thread s) s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to (cur_thread s) s \<and> (\<forall>n\<le>msg_max_length. n < 2 ^ word_bits) \<and> ex_nonz_cap_to (cur_thread s) s
 2. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and (invs' and tcb_at' (ksCurThread s) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues sa (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> tcb_at' (ksCurThread s) sa \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> invs' sa \<and> invs' sa \<and> sch_act_simple sa \<and> True \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> True \<and> valid_objs' sa \<and> valid_objs' sa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) sa \<and> invs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> ksCurThread s = ksCurThread sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace sa))))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; invs s; valid_list s; valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); scheduler_action s = resume_cur_thread; st_tcb_at active (cur_thread s) s\<rbrakk> \<Longrightarrow> ex_nonz_cap_to (cur_thread s) s
 2. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and (invs' and tcb_at' (ksCurThread s) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues sa (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> tcb_at' (ksCurThread s) sa \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> invs' sa \<and> invs' sa \<and> sch_act_simple sa \<and> True \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> True \<and> valid_objs' sa \<and> valid_objs' sa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) sa \<and> invs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> ksCurThread s = ksCurThread sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace sa))))) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s st. \<lbrakk>c \<longrightarrow> b; invs s; valid_list s; valid_sched_2 (ready_queues s) (ekheap s) resume_cur_thread (cur_domain s) (kheap s) (cur_thread s) (idle_thread s); scheduler_action s = resume_cur_thread; active st; halted st\<rbrakk> \<Longrightarrow> False
 2. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and (invs' and tcb_at' (ksCurThread s) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues sa (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> tcb_at' (ksCurThread s) sa \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> invs' sa \<and> invs' sa \<and> sch_act_simple sa \<and> True \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> True \<and> valid_objs' sa \<and> valid_objs' sa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) sa \<and> invs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> ksCurThread s = ksCurThread sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace sa))))) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; (invs' and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and (\<lambda>s. ksSchedulerAction s = ResumeCurrentThread) and ct_active') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. (tcb_at' (ksCurThread s) and (tcb_at' (ksCurThread s) and (invs' and tcb_at' (ksCurThread s) and (\<lambda>sa. invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>p. ksCurThread s \<notin> set (ksReadyQueues sa p)) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> invs' sa \<and> sch_act_not (ksCurThread s) sa \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues sa (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> tcb_at' (ksCurThread s) sa \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> valid_objs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> tcb_at' (ksCurThread s) sa \<and> invs' sa \<and> st_tcb_at' simple' (ksCurThread s) sa \<and> ex_nonz_cap_to' (ksCurThread s) sa \<and> ksCurThread s \<noteq> ksIdleThread sa \<and> invs' sa \<and> invs' sa \<and> sch_act_simple sa \<and> True \<and> valid_objs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> invs' sa \<and> True \<and> valid_objs' sa \<and> valid_objs' sa \<and> (invs' and K (\<forall>cap. isCNodeCap cap \<longrightarrow> isCNodeCap cap)) sa \<and> invs' sa \<and> vs_valid_duplicates' (ksPSpace sa) \<and> ksCurThread s = ksCurThread sa \<and> ksSchedulerAction sa = ResumeCurrentThread \<and> vs_valid_duplicates' (ksPSpace sa))))) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; invs' s; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; ct_active' s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> valid_objs' s \<and> tcb_at' (ksCurThread s) s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; invs' s; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; ct_active' s; tcb_at' (ksCurThread s) s\<rbrakk> \<Longrightarrow> tcb_at' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> tcb_at' (ksCurThread s) s \<and> valid_objs' s \<and> tcb_at' (ksCurThread s) s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksCurThread s) s; tcb_at' (ksCurThread s) s; valid_pspace' s; st_tcb_at' activatable' (ksCurThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s\<rbrakk> \<Longrightarrow> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> valid_objs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksCurThread s) s; tcb_at' (ksCurThread s) s; valid_pspace' s; st_tcb_at' activatable' (ksCurThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>d p. ksCurThread s \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> valid_objs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksCurThread s) s; tcb_at' (ksCurThread s) s; valid_pspace' s; st_tcb_at' activatable' (ksCurThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>d p. ksCurThread s \<notin> set (ksReadyQueues s (d, p)); st_tcb_at' simple' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> valid_objs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksCurThread s) s; tcb_at' (ksCurThread s) s; valid_pspace' s; st_tcb_at' activatable' (ksCurThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksCurThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>d p. ksCurThread s \<notin> set (ksReadyQueues s (d, p)); st_tcb_at' simple' (ksCurThread s) s; ex_nonz_cap_to' (ksCurThread s) s\<rbrakk> \<Longrightarrow> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> (\<forall>a b. ksCurThread s \<notin> set (ksReadyQueues s (a, b))) \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> valid_objs' s \<and> st_tcb_at' simple' (ksCurThread s) s \<and> ex_nonz_cap_to' (ksCurThread s) s \<and> ksCurThread s \<noteq> ksIdleThread s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksIdleThread s) s; tcb_at' (ksIdleThread s) s; st_tcb_at' activatable' (ksIdleThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksIdleThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>d p. ksIdleThread s \<notin> set (ksReadyQueues s (d, p)); st_tcb_at' simple' (ksIdleThread s) s; ex_nonz_cap_to' (ksIdleThread s) s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; ksCurThread s = ksIdleThread s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>c \<longrightarrow> b; vs_valid_duplicates' (ksPSpace s); ksSchedulerAction s = ResumeCurrentThread; st_tcb_at' active' (ksIdleThread s) s; tcb_at' (ksIdleThread s) s; st_tcb_at' activatable' (ksIdleThread s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; obj_at' (Not \<circ> tcbQueued) (ksIdleThread s) s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; \<forall>d p. ksIdleThread s \<notin> set (ksReadyQueues s (d, p)); st_tcb_at' simple' (ksIdleThread s) s; ex_nonz_cap_to' (ksIdleThread s) s; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; ksCurThread s = ksIdleThread s; active' Structures_H.thread_state.IdleThreadState\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!